California data breach notification rules for agencies
By Tyler Mayberry · Cirlet. Published . Page updated .
A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.
California has not adopted the NAIC Insurance Data Security Model Law. Its breach law, Civil Code section 1798.82, applies to agencies. From January 1, 2026, SB 446 requires notice to affected residents within 30 calendar days of discovering the breach.
The rules at a glance
| General breach notice (any business) | Notify California residents whose unencrypted personal information was acquired (Civil Code § 1798.82). SB 446 (2025), effective January 1, 2026, sets 30 calendar days from discovery or notification, with delays allowed for law enforcement and to determine the breach’s scope. |
|---|---|
| Notice to the Attorney General | If more than 500 California residents are notified for one breach, electronically submit a single sample copy of the notice, without personal information (Attorney General guidance). Under SB 446 the sample is due within 15 days of notifying residents. |
NAIC model law: Not adopted. The NAIC does not show California as adopting its Insurance Data Security Model Law (status as of October 8, 2026). Other California insurance privacy rules can still apply.
California agencies’ public email records
In our October 2026 check of 47 California independent agency website domains, 42 (89%) published one SPF record, 22 (47%) published a DMARC record and 11 (23%) asked receivers to quarantine or reject mail that fails. Public records show what a domain asks of receivers. They do not show whether an agency’s accounts or inboxes are protected.
What to prepare now
- Write down who decides that a cybersecurity event has occurred, and who files the notice, with a backup person.
- Keep the regulator’s notice route and the deadline above where you can reach them when email is unavailable.
- Ask your IT provider for evidence of multi-factor authentication on email and agency systems, and a list of everyone with administrator access.
- List the vendors that hold client information and how each will tell you about an incident.
Rehearse losing email access · Prepare for email fraud
California questions
How long does a California agency have to notify affected residents?
Under SB 446, effective January 1, 2026, 30 calendar days from discovering or being notified of the breach, with limited delays for law enforcement or to determine the breach’s scope.
When must a California agency involve the Attorney General?
When more than 500 California residents are notified because of one breach. Submit a single sample notice electronically, without personal information, within 15 days of notifying residents.
Does California have an insurance data security law?
Not the NAIC model law. As of October 8, 2026 the NAIC does not show California as adopting it. Other California privacy rules for insurance can still apply, so ask counsel which ones cover your agency.
Sources
- California Civil Code § 1798.82
- California Attorney General: submit a data security breach
- Moore & Van Allen summary of SB 446, November 11, 2025
- NAIC Model #668 adoption map, status as of October 8, 2026
Other states: Missouri · Ohio · New York · Texas · All state pages