Got a Data Breach Notice? What to Do in California, and When to Write

What should you do first after a data breach in California?

Protect your accounts before thinking about a claim. These steps take an afternoon and do not depend on what the company does next.

1. Read the notice closely and save it, with the envelope or email header.
2. Freeze your credit at Equifax, Experian and TransUnion. The FTC says there is no cost to place or lift a freeze, and it does not affect your credit score.
3. Consider a fraud alert as well. An initial alert lasts one year; an extended alert, for identity theft victims, lasts seven years.
4. Change the password on the breached account and on any other account that used the same password or security answers.
5. Turn on two-step sign-in wherever it is offered.
6. Accept any identity theft protection the company offers, and note the enrollment deadline.
7. Check your bank and card statements, and pull your credit reports, for activity you do not recognize.

The California Attorney General keeps a searchable list of breach notices sent to more than 500 California residents. The company that writes to you may not be the one that was breached; a bank, for example, may notify customers about a merchant's breach.

What does California require a data breach notice to include?

Civil Code section 1798.82 requires a plain-language notice titled Notice of Data Breach, with sections headed What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. It must list the types of personal information involved, the date or date range of the breach if known, and contact information for the business.

• Timing (as of October 2026): SB 446, effective January 1, 2026, requires notice within 30 calendar days of discovery or notification of the breach. Delays are allowed for law enforcement needs or to determine the scope of the breach and restore the system.
• Credit bureau contacts: If Social Security, driver's license or California ID numbers were exposed, the notice must include the bureaus' toll-free numbers and addresses.
• Identity theft services: If the business was the source of a breach involving those numbers, it must offer identity theft prevention and mitigation services at no cost for at least 12 months.
• Attorney General copy: A business notifying more than 500 California residents must send a sample copy to the Attorney General within 15 calendar days of notifying consumers.

Can you sue a company for a data breach in California?

Sometimes. The California Consumer Privacy Act gives consumers a private right of action for one kind of violation: a breach caused by a business's failure to implement and maintain reasonable security (Civil Code section 1798.150). Other CCPA violations are enforced by the Attorney General and the California Privacy Protection Agency, not through private suits under the act. The claim also runs only against a business the CCPA covers, for example a company whose yearly gross revenue tops $26,625,000 (the 2025 figure).

The dollar range in the statute reads $100 to $750, but the law requires inflation adjustments. The California Privacy Protection Agency set the current range at $107 to $799, effective January 1, 2025. In choosing an amount, a court considers factors such as the seriousness and persistence of the misconduct, its willfulness, and the business's assets and net worth.

How does the 30-day notice before a breach claim work?

Before suing for statutory damages, individually or as a class, you must give the business 30 days' written notice identifying the specific provisions of the CCPA you say it violated (section 1798.150(b)). A demand letter is one way to give it.

• If a cure is possible and the business actually cures within 30 days, and sends an express written statement that the violations are cured and will not recur, statutory damages are off the table.
• Adding reasonable security after the breach does not count as a cure for that breach.
• No notice is needed for a suit seeking only actual money losses.
• If the business breaks its written statement later, you can sue to enforce it and seek statutory damages for each breach of the statement.

Keep proof of when the business received the letter, since the 30 days run from that notice. Delivery options are compared in sending a demand letter so you can prove it arrived.

Checklist: what to keep after a breach

• The breach notice and the date you received it.
• Screenshots of the Attorney General's listing for the breach, if any.
• Records of time spent and costs paid: credit monitoring you bought, bank fees, replacement IDs, missed work.
• Any fraudulent charges, accounts or tax filings, with police or FTC identity theft reports.
• Your letters to the business and its replies.
• Any class action notice you receive. Joining a class or opting out affects your individual claim, so read it carefully and consider advice.

Example (hypothetical): a shopper's name and driver's license number are taken from an online retailer's systems. Two months later, someone opens a card account in her name. Her letter documents the $240 she spent on a replacement license, certified mail and a credit monitoring plan, and 11 hours of lost work, so her actual damages are stated alongside the statutory range.

When an attorney-written breach notice letter makes sense

The 30-day notice must identify the specific provisions you claim were violated, so precise drafting matters. Consider having a lawyer write it when your Social Security, medical or financial information was taken, when you have already suffered fraud or out-of-pocket costs, or when the company's own notice was late or incomplete. For a broader view of the format, see what goes into a demand letter.

Talk to My Lawyer can prepare that notice: a licensed California attorney writes your letter from the breach notice and your records, frames the section 1798.150 notice, and sends it on your behalf. Suing, joining a class action or opting out of one are decisions for a conversation with a lawyer about your own facts.