Data breaches: customer notification.

Senator Hurtado's data breach notification measure establishes specific timelines for California businesses to inform consumers and regulators about security incidents. Under the proposal, organizations must notify affected California residents within 30 calendar days of discovering a data breach, while retaining flexibility to delay disclosure for law enforcement needs or to determine the breach's scope.

The legislation also requires businesses to submit sample breach notifications to the Attorney General within 15 calendar days of informing consumers when incidents affect more than 500 California residents. These notifications must follow a standardized format with plain language headers covering what happened, what information was involved, response measures, and guidance for affected individuals.

The measure maintains existing requirements for notification content, including breach timing details, types of compromised data, and whether law enforcement investigations caused any delays. Organizations must continue providing identity theft prevention services at no cost for 12 months when social security numbers or driver's license information is exposed. Alternative notification methods remain available when standard notice would exceed $250,000 or affect more than 500,000 people.