Help us improve
Share bugs, ideas, or general feedback.
Guides California data breach notifications under Civ. Code §1798.82: triggering data elements (SSN, DL, financial, health, biometrics), timing (expedient), AG notice for 500+ residents, content/format.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeHow this skill is triggered — by the user, by Claude, or both
Slash command
/privacy-skills-complete:ca-breach-notificationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
California was the first US state to enact a data breach notification law (SB 1386, 2003). Cal. Civ. Code §1798.82 requires any person, business, or state agency that owns or licenses computerized data containing personal information to notify California residents when unencrypted personal information has been (or is reasonably believed to have been) acquired by an unauthorized person. The Cali...
Guides California data breach notifications under Civ. Code §1798.82: triggering data elements (SSN, DL, financial, health, biometrics), timing (expedient), AG notice for 500+ residents, content/format.
Executes HIPAA breach notification workflow per 45 CFR 164.400-414: four-factor risk assessment, 60-day individual notices, HHS/OCR reports (500+ immediate, <500 annual), AG/media alerts. For healthcare privacy compliance.
Executes LGPD security incident response runbook (Art. 48 LGPD + Resolução CD/ANPD nº 15/2024): guides 3-day notification deadlines, ANPD/subject notification items, and 5-year record retention.
Share bugs, ideas, or general feedback.
California was the first US state to enact a data breach notification law (SB 1386, 2003). Cal. Civ. Code §1798.82 requires any person, business, or state agency that owns or licenses computerized data containing personal information to notify California residents when unencrypted personal information has been (or is reasonably believed to have been) acquired by an unauthorized person. The California Attorney General must be notified when more than 500 California residents are affected.
A breach notification is triggered when an individual's first name or first initial and last name is combined with any of the following unencrypted or unredacted data elements:
| Data Element | Category |
|---|---|
| Social Security number | Government identifier |
| Driver's license number or California identification card number | Government identifier |
| Financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password | Financial |
| Medical information | Health |
| Health insurance information | Health |
| Unique biometric data (fingerprint, retina, iris image, or other unique physical representation or digital representation used for authentication) | Biometric |
| Information or data collected through automated license plate recognition systems | Surveillance |
| Genetic data | Genetic |
| A username or email address, in combination with a password or security question and answer that would permit access to an online account | Credentials |
| Tax identification number | Government identifier |
Note: "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
Cal. Civ. Code §1798.82(a): Notification must be made "in the most expedient time possible and without unreasonable delay."
Notification may be delayed if a law enforcement agency determines that notification would impede a criminal investigation. The notification must be made "promptly" after the law enforcement agency determines notification will not compromise the investigation.
| Requirement | Detail |
|---|---|
| Threshold | 500 or more California residents affected |
| Method | Electronic submission to the California AG's office (oag.ca.gov/privacy/databreach/reporting) |
| Content | Sample copy of the individual notification letter |
| Timing | Concurrent with or before individual notification |
The notification must include:
California has specific formatting requirements for breach notification letters:
Substitute notice is permitted when:
Substitute notice must include ALL of the following:
Encrypted personal information is excluded from the notification requirement IF:
The California Consumer Privacy Act (CCPA) as amended by CPRA provides a private right of action for data breaches under Cal. Civ. Code §1798.150:
To: California Office of the Attorney General Privacy Enforcement Section oag.ca.gov/privacy/databreach/reporting
Re: Data Breach Notification — Stellar Payments Group Breach Date: 13 March 2026 California Residents Affected: 2,340
Pursuant to Cal. Civ. Code §1798.82(f), Stellar Payments Group hereby provides notice of a data breach affecting 2,340 California residents. Enclosed is a sample copy of the notification letter being sent to affected individuals. Individual notifications will be dispatched on 28 March 2026.
Contact: Dr. Elena Vasquez, DPO, dpo@stellarpayments.eu, +1 (202) 555-0142.