Meet SB 1386 breach notification duties with confidence

SB 1386 is California's data breach notification law. Passed in 2002 and in force since 1 July 2003, it was the first US state law requiring organisations to tell people when their personal information is breached. It is codified in Civil Code sections 1798.29 for state agencies and 1798.82 for businesses, and has been amended many times, most recently by SB 446, which took effect on 1 January 2026.

Any person or business that owns or licenses computerised data containing personal information about California residents must comply, wherever it is based, and state agencies have parallel duties under section 1798.29. Organisations that maintain personal data they do not own must notify the owner or licensee immediately after discovering a breach, so the owner can notify affected residents.

Since 1 January 2026, businesses must notify affected California residents within 30 calendar days of discovering or being notified of a breach, following SB 446. Delay is allowed when law enforcement says notice would impede a criminal investigation, or where needed to determine the scope of the breach and restore system integrity. If more than 500 residents are notified, a sample notice must reach the Attorney General within 15 calendar days of notifying residents.

A California breach notice must be written in plain language, titled "Notice of Data Breach", and use the headings What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. It must describe the types of personal information involved, the date or estimated date of the breach where known, and contact details, including credit reporting agency details where Social Security or driver's licence numbers were exposed.

Generally yes. The duty applies to unencrypted personal information, so a breach of properly encrypted data is not notifiable, unless the encryption key or security credential was also acquired, or is reasonably believed to have been acquired, by an unauthorised person. This makes strong encryption and key management one of the most effective ways to reduce breach notification exposure in California.

Customers injured by a business's violation can sue for damages under Civil Code section 1798.84, and a business that violates the law may be enjoined. The Attorney General can also take action. Separately, the CCPA gives consumers a private right of action, with statutory damages, when certain personal information is breached because a business failed to maintain reasonable security.

SB 1386 governs what happens after a breach, while the CCPA governs how businesses collect and use Californians' personal information and adds a private right of action for breaches caused by poor security. GDPR has its own 72 hour regulator notification rule. ISO 27001 does not require notification, but its incident management controls provide the process you need to meet SB 1386 deadlines.

Yes, on request. California SB 1386 is mapped in OneClickComply's control library and can be enabled for your account. We map its notification and reporting duties to incident response controls, generate policies from your environment and collect evidence automatically, so the work also counts towards CCPA, ISO 27001 and SOC 2. Compliance is judged by the Attorney General and the courts, not by a certificate.