California's 30-Day Breach Rule: Holiday Checklist for LA Shops

The busiest selling weeks of the year are also when small online businesses collect the most customer data: new accounts, saved cards, shipping addresses, loyalty sign-ups and email lists pulled in from pop-ups and holiday promotions. For Los Angeles shops, studios and direct-to-consumer brands, this is the first holiday season under a tighter California rule on what happens when that data leaks. Since January 1, 2026, businesses have a hard 30-day clock to notify affected customers.

This article is general information, not legal advice. If you suspect a breach, talk to a qualified attorney and security professional promptly.

What the law now says

California's breach notification statute, Civil Code Section 1798.82, has long required businesses to tell California residents when their unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The old standard was "in the most expedient time possible and without unreasonable delay." SB 446, signed in October 2025, added a firm deadline:

• 30 calendar days from discovery or notification of the breach to notify affected residents. A delay is allowed for legitimate law enforcement needs, or as necessary to determine the scope of the breach and restore the reasonable integrity of the system.
• 15 calendar days after notifying consumers to send a sample copy of the notice to the Attorney General, if more than 500 California residents were affected. The Attorney General's office posts those samples publicly.

Thirty days sounds like plenty until you are trying to figure out what happened, which customers were affected and how to reach them during peak season.

What counts as personal information

The law is narrower than "any customer data," but it covers more than card numbers. Under the statute, it includes a person's name combined with items such as a Social Security number, a driver's license or other government ID number, a financial account or card number together with the code needed to access it, medical or health insurance information, biometric data used for authentication, or genetic data. It also covers a username or email address combined with a password or security question that would allow access to an online account.

That last category matters for any shop with customer logins. A credential leak can trigger the law even if no payment data was touched.

Encryption helps. Encrypted data is generally outside the notice requirement unless the encryption key or credential was also compromised.

What the notice has to look like

California is specific about format. The notice must be titled "Notice of Data Breach," written in plain language and organized under set headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. It must use at least 10-point type and include details such as the types of information involved and, if known, the date or date range of the breach.

If your business was the source of the breach and Social Security or government ID numbers were exposed, the law requires offering at least 12 months of free identity theft prevention and mitigation services.

Your vendors are part of this

Most small sellers run on platforms: an e-commerce host, payment processor, email marketing tool, booking app or a freelance developer with admin access. The statute says a business that maintains personal data it does not own must notify the owner immediately after discovering a breach. In practice, that means your vendor contracts and contact lists should make it clear who tells whom, and how fast.

Why it matters beyond the notice

For businesses that meet the thresholds of the California Consumer Privacy Act, there is also a private right of action when certain nonencrypted, nonredacted personal information is exposed because of a failure to maintain reasonable security. Under an inflation adjustment the California Privacy Protection Agency announced for 2025, statutory damages run from $107 to $799 per consumer per incident, or actual damages if greater. Even for small companies outside the CCPA, the reputational cost of a sloppy response can outlast the incident.

A holiday-season checklist

These are practical suggestions, not legal requirements:

1. Inventory your customer data. Know which systems hold names, logins, card data and IDs, and delete what you do not need.
2. Turn on multifactor authentication for every admin account on your store, email, payment and marketing tools, including seasonal staff.
3. Remove old access. Revoke logins for former contractors and agencies before the rush.
4. Confirm encryption with your platforms for stored customer data.
5. Write a one-page incident plan naming who investigates, who calls your attorney and insurer, and who drafts the customer notice. The FTC's Data Breach Response guide is a useful free starting point.
6. Pre-draft a notice template using California's required headings so you are not writing from scratch on day 25.
7. Check your insurance. Ask whether your policy covers breach response, notification costs and forensic work.

A breach is stressful at any time of year. With a 30-day deadline, the businesses that handle it well are usually the ones that did an hour of preparation before it happened.