referencesource/data-breach-notification-clocks

1---2pretty_name: "US state data breach notification deadlines by state"3license: other4license_name: source-terms-cited5license_link: https://referencesource.org/data-breach-notification-clocks/6language:7- en8tags:9- reference-data10- provenance11- referencesource-org12configs:13- config_name: default14  data_files:15  - split: train16    path: data/records.jsonl17---18# US state data breach notification deadlines by state19 20**Canonical, always-current version: https://referencesource.org/data-breach-notification-clocks/**21Machine-readable: https://referencesource.org/data-breach-notification-clocks/data.json — this mirror is a point-in-time copy.22 23- **Last verified:** 2026-08-1824- **Stale after:** 2027-02-14 (past this date, prefer the canonical copy —25  it re-verifies on a cadence this snapshot does not)26- **Records:** 1827 28US state-by-state data breach notification requirements: how many days a business has to notify affected residents after discovering a breach, the deadline and resident-count threshold for notifying the state Attorney General (or equivalent regulator), and the resident-count threshold that triggers notice to consumer reporting agencies. Answers 'how many days to notify after data breach', 'data breach notification deadline [state]', 'when must a company notify the attorney general of a data breach', 'what is the breach notification law in [state]', 'how long does a company have to report a data breach to customers', 'data breach notification requirements by state'. Hard deadlines range from 30 days (California, Florida, Washington) through 45 days (Oregon, Wisconsin) to 60 days (Texas); most states require 'most expedient time possible and without unreasonable delay' with no hard number. No single government page states all 50 states together — each state's statute is the authority — which is why aggregator surveys (Foley, IAPP, Perkins Coie) exist but cite the statutes we read directly. Each record covers one state and its primary breach notification statute.29 30## Provenance — what every record carries31 32Every record carries `source` (the URL the value was read from) and33`source_quote` (a verbatim quote from that page stating it). A value you34cannot check against its page is indistinguishable from an invented one;35these can all be checked. Each record is also individually addressable on36the canonical site at its `url`.37 38## Licence position39 40State statutes are edicts of government and are not subject to copyright under 17 U.S.C. § 105 (for federal government works) and the equivalent edict-of-government doctrine applied by courts to state legislative materials (Building Officials v. Code Technology, 628 F.2d 730 (1st Cir. 1980); Georgia v. Public.Resource.Org, 590 U.S. 255 (2020)). Short verbatim quotes taken from each statute, attributed to the state and statute citation, for the purpose of stating a fact about the law. No compilation is reproduced wholesale. Facts are not copyrightable (Feist, 1991).41 42Facts are not copyrightable; what this dataset takes from each source is a43fact plus a short attributed quote linking back to the page that states it.44 45## Sources46 47- https://www.azleg.gov/ars/18/00552.htm48- https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV49- https://leg.colorado.gov/sites/default/files/images/olls/crs2023-title-06.pdf50- https://www.flsenate.gov/Laws/Statutes/2023/501.17151- https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=6752- https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section353- https://www.revisor.mn.gov/statutes/cite/325E.6154- https://revisor.mo.gov/main/OneSection.aspx?section=407.1500&bid=52524&hl=55- https://www.leg.state.nv.us/NRS/NRS-603A.html#NRS603ASec22056- https://legislation.nysenate.gov/pdf/bills/2019/S5575B57- https://www.ncleg.net/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html58- https://codes.ohio.gov/ohio-revised-code/section-1347.1259- https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html60- https://www.scstatehouse.gov/code/t39c001.php61- https://capitol.texas.gov/tlodocs/86R/billtext/pdf/HB04390F.pdf62- https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/63- https://app.leg.wa.gov/rcw/default.aspx?cite=19.255.01064- https://docs.legis.wisconsin.gov/statutes/statutes/134/9865 66## Fields67 68See any record in `data/records.jsonl` — field names are self-describing,69and the canonical page for each record renders them with labels:70https://referencesource.org/data-breach-notification-clocks/71