Data Breach - The Nourmand Law Firm

California’s New 30-Day Data Breach Notification Deadline

The Nourmand Law Firm, APC — Fri, 31 Jul 2026 13:58:57 GMT

Last updated July 28, 2026 · Reviewed by Michael Nourmand

A California law that took effect January 1, 2026 now requires businesses to disclose a data breach within 30 calendar days of discovering it, replacing an older standard that let companies take as long as they reasonably needed. Senate Bill 446 amended the state’s breach-notification statute, Cal. Civ. Code § 1798.82, and the change reaches anyone whose personal information a California business collects or holds.

The practical effect is a faster warning. A company that discovers a breach now has a fixed 30-day window to notify each affected California resident, so a notice that arrives months after an incident is a sign the business may have missed its legal deadline. That timing also shapes your options, because California is one of the few states that lets a consumer sue over a breach directly.

What Senate Bill 446 Changed for California Breach Notices

A data breach notification is the letter or email a business must send when it learns that unencrypted personal information in its systems was accessed by someone not authorized to see it. Before Senate Bill 446, § 1798.82 required that notice go out “in the most expedient time possible and without unreasonable delay,” a standard vague enough that some companies waited months. The amended statute sets a hard number.

Under Senate Bill 446, effective January 1, 2026, a California business that discovers a data breach must notify each affected resident within 30 calendar days. Limited extensions still exist where law enforcement asks a company to hold notice, or where the business needs time to identify who was affected, but the default is now a firm deadline rather than an open one. The Nourmand Law Firm represents California consumers and workers whose personal information is exposed in these breaches, and the firm’s California data breach practice explains how the resulting claims work.

Why Does a Late Data Breach Letter Matter Now?

The deadline gives the notice letter a second job. It has always told you what was exposed, but under the new rule its timing also shows whether the business complied with the law. A letter dated well beyond 30 days after the company learned of the breach raises a direct question about whether the notification duty was met, and that question can support a claim on its own.

Late notice compounds the harm, which is the reason the Legislature tightened the rule. Every extra week that a person does not know their Social Security or financial account number is circulating is a week they cannot place a credit freeze, watch their accounts, or catch fraud early. The 30-day deadline exists to close that gap, and a business that ignores it leaves its customers and employees exposed for longer than California law now allows.

What Can You Recover After a California Data Breach?

Notification is only part of the picture. Under Cal. Civ. Code § 1798.150, a consumer whose nonencrypted personal information is exposed because a business failed to maintain reasonable security may recover statutory damages of $100 to $750 per incident, or actual damages if they are greater. The claim does not require proof that any money was lost, which is why exposure alone can matter.

Because a single breach usually affects thousands or hundreds of thousands of Californians at once, these cases often proceed as class actions rather than individual suits. The Nourmand Law Firm has recovered between $1.35 million and $7.25 million in past class action cases, and it applies that group-litigation experience to breaches that expose large California populations. Cases are handled on a no recovery, no fee basis.

What Should You Do When a Breach Notice Arrives?

Treat the letter as a prompt to act, not a formality to file away. The most important steps happen in the first days, while the exposed information is fresh and the deadlines are still open. The detailed sequence, from placing a credit freeze to preserving the letter, is set out in the firm’s guide on what to do after a data breach letter.

Two moves are worth doing immediately. Place a free security freeze with all three credit bureaus, which blocks new accounts from being opened in your name. Then confirm the incident against the California Attorney General’s public breach list, where breaches affecting more than 500 residents are posted, so you can see the company’s own account of what happened and when.

Questions About California’s New Breach Notice Deadline

How Soon Must a California Business Report a Data Breach?

Within 30 calendar days of discovering the breach, under Senate Bill 446 and Cal. Civ. Code § 1798.82, effective January 1, 2026. Narrow extensions apply for law enforcement or to determine the scope of the breach, but the earlier open-ended “without unreasonable delay” standard no longer controls.

Does a Breach Notice Mean I Automatically Have a Case?

No. A notice means your information was exposed, not that a claim is guaranteed. Whether one exists turns on what data was involved and whether the business maintained reasonable security. Under Cal. Civ. Code § 1798.150, a consumer can sue when nonencrypted personal information is exposed through that kind of security failure.

How Much Can I Recover if My Information Was Breached?

Statutory damages run from $100 to $750 per consumer per incident under Cal. Civ. Code § 1798.150, or actual damages if they are greater. No proof of an out-of-pocket loss is required for the statutory amount, and documented losses such as fraud and credit repair can be recovered on top.

Contact The Nourmand Law Firm About a Breach Notice

If you received a data breach letter, or learned that a company holding your information was breached, The Nourmand Law Firm can review the notice and the timing at no charge. The firm represents the California consumers and workers whose data was exposed, never the businesses that lost it, and works in English and Spanish. Contact The Nourmand Law Firm at 800-700-WAGE (9243) or through its contact page to have your situation reviewed on a no recovery, no fee basis.

What Are Your Rights After a Medical Data Breach in California?

The Nourmand Law Firm, APC — Tue, 30 Jun 2026 14:11:45 GMT

Last updated June 30, 2026 · Reviewed by Michael Nourmand

Medical records hold some of the most sensitive information a person has, and California law treats a breach of that data more seriously than most. When a health care provider, an insurer, or one of their vendors exposes confidential medical information, the state’s Confidentiality of Medical Information Act gives the affected patient a direct remedy, separate from the general data breach statutes.

Under the Confidentiality of Medical Information Act, a patient whose medical information is negligently released can recover $1,000 in nominal damages for each violation, without proving any financial loss. That remedy sits alongside California’s broader breach-notification and consumer-privacy laws, so one exposure of health data can support more than a single claim. The Nourmand Law Firm represents California patients and workers whose private information is exposed, and its California data breach practice covers how these claims fit together.

What the Confidentiality of Medical Information Act Protects

The Confidentiality of Medical Information Act is California’s medical-privacy statute, codified at Cal. Civ. Code § 56 and the sections that follow, which restricts how a provider or its contractors may disclose a patient’s medical information and lets a patient sue when that information is released without authorization. It reaches individually identifiable details about a person’s medical history, mental or physical condition, and treatment.

The law binds more than hospitals and doctors. Health care service plans, laboratories, billing companies, and other contractors that receive medical information are covered too, which matters because many breaches happen at a vendor rather than at the provider itself. A patient whose records were exposed through a third party still has rights under the statute.

What Can You Recover After a Medical Data Breach?

Under Cal. Civ. Code § 56.36, a patient whose medical information is negligently released may recover nominal damages of $1,000 for each violation, even without proof of an actual loss. Where the breach caused real harm, actual damages are recoverable on top of that figure.

Health data breaches often trigger California’s general laws as well. Medical and health insurance information are covered data elements under the breach-notification statute, § 1798.82, and the consumer private right of action under Cal. Civ. Code § 1798.150 allows statutory damages of $100 to $750 per incident when unencrypted personal information is exposed through weak security. One breach can therefore carry overlapping remedies. The Nourmand Law Firm has recovered between $1.35 million and $7.25 million in past class action cases, and it brings that experience to breaches affecting large groups of patients on a no recovery, no fee basis.

Who Can Be Held Responsible for a Medical Data Breach?

Responsibility turns on who held the data and how it was handled, not simply on who was hacked. A hospital or medical practice that failed to secure its systems can be liable, and so can a health plan, a laboratory, or a billing and collections vendor that received the records under contract. The Confidentiality of Medical Information Act extends to these contractors precisely so that outsourcing sensitive data does not outsource the duty to protect it.

The standard is negligence. A patient does not have to show that a business intended to expose the records, only that it failed to use reasonable care in safeguarding them. That is why the security practices a provider or vendor had in place, and whether they matched the sensitivity of the information, sit at the center of these cases.

What Should You Do if Your Medical Records Were Exposed?

Act quickly, because the same steps that protect your identity also preserve a potential claim. Keep the breach notice and any letter describing what was exposed, place a security freeze with the three credit bureaus, and review your medical and insurance statements for care or charges you did not authorize, which can be a sign of medical identity theft. The firm’s guide on what to do after a data breach letter walks through the full sequence.

Watch for the enrollment terms in any credit monitoring the business offers. Some of those offers ask a patient to accept arbitration or release claims in exchange for the service, and signing up should not require giving up the right to sue over the breach.

Common Questions About Medical Data Breaches in California

Does HIPAA Let Me Sue After a Medical Data Breach?

No. The federal HIPAA law sets privacy standards but does not give an individual a private right to sue. In California, the path to a personal remedy runs through state law, chiefly the Confidentiality of Medical Information Act and, where personal information beyond medical records was exposed, Cal. Civ. Code § 1798.150.

How Much Is a Medical Data Breach Claim Worth in California?

It depends on what was exposed and how many people were affected. The Confidentiality of Medical Information Act allows nominal damages of $1,000 per violation under Cal. Civ. Code § 56.36 with no proof of loss, and statutory damages of $100 to $750 per incident may also apply under § 1798.150. Actual losses are recoverable on top.

Is a Breach at My Doctor’s Billing Company Covered?

Yes. Contractors that receive medical information, including billing and collections companies, laboratories, and health plans, are bound by the Confidentiality of Medical Information Act. A patient whose records were exposed at one of those vendors has the same rights as if the breach happened at the provider’s own office.

Contact The Nourmand Law Firm About a Medical Data Breach

If your medical records were exposed in a California breach, The Nourmand Law Firm can review what happened and explain your options at no charge. The firm represents the patients and workers whose information was compromised, never the companies that lost it, and works in English and Spanish. Contact The Nourmand Law Firm at 800-700-WAGE (9243) or through its contact page to have your situation reviewed on a no recovery, no fee basis.