Data breach notification laws by state: twelve states, read directly

No single US law sets a data breach notification deadline. All fifty states have their own, and they disagree on nearly everything: how many days a company has, how many residents a breach has to affect before the attorney general gets a copy, and whether there's a numeric deadline at all. This guide reads twelve states' own statutes and attorney general guidance directly — California, Texas, New York, Massachusetts, Washington, Virginia, Ohio, Colorado, North Carolina, Minnesota, Maryland and Arizona — rather than a secondary 50-state roundup, built up in batches toward a fuller record.

Why do breach-notification deadlines differ so much by state?

Because each state legislature wrote its own statute, usually amending it piecemeal over fifteen-plus years rather than adopting a model law wholesale. The result sorts into three patterns among these twelve: a fixed day-count from discovery (Ohio's, Maryland's and Arizona's 45 days, New York's and Washington's 30 days, Colorado's 30 days, Texas's 60 days to individuals and separate 30 days to the attorney general); an undefined "most expedient time possible and without unreasonable delay" standard with no outer day limit (Massachusetts, Virginia, North Carolina and Minnesota); and a mix of the two, where the day-count is a backstop on top of the expedience standard (Colorado and Washington state both phrases together, Ohio, Maryland and Arizona do not use the expedience phrase at all in the sections read). None of the twelve gives a company more time just because a breach is large; several of the day-counts run from the date of discovery or determination, not from when notice is finally sent.

Which states require notice to the attorney general, and at what threshold?

Ten of the twelve do, and they split into three different kinds of threshold. Four set no minimum count at all: New York requires attorney general notice whenever any New York resident is notified; Massachusetts does the same, naming the attorney general and the state's director of consumer affairs and business regulation as co-recipients; Virginia requires notice to its Office of the Attorney General together with the resident notice; and Maryland goes further still, requiring attorney general notice before the company may even notify individuals, also with no numeric threshold. Four peg the duty to how many of the state's own residents were affected: California, Washington and Colorado all set it above 500 residents, Texas above 250. The remaining two — North Carolina and Arizona — peg the threshold differently: not to how many residents of that state were affected, but to how many people in total the breach requires notifying (more than 1,000), a subtly different test from the resident-count states. Ohio and Minnesota, in the sections of each statute read this run, have no requirement to notify the attorney general at all — Ohio's only third-party notice trigger is to nationwide consumer reporting agencies above 1,000 residents, and Minnesota's statute as read (subdivisions 1, 2, 3, 4 and 6; subdivision 5 was renumbered into a different section not read this run) names only the attorney general's enforcement authority, not a pre-notice duty.

The twelve states, state by state

• California — Civil Code § 1798.82 (businesses) and § 1798.29 (state agencies). Attorney general notice required above 500 California residents affected, submitted electronically through the AG's own form. This guide could not independently confirm the statute's own notice-timing language this run: leginfo.legislature.ca.gov returned HTTP 403 to this network's required User-Agent on every attempt, the same kind of block this network has documented for other government sources it cannot yet read directly. The 500-resident attorney-general threshold above is sourced to the Attorney General's own breach-reporting page, not the statute text itself.

• Texas — Business and Commerce Code ch. 521 (the Identity Theft Enforcement and Protection Act). Individuals: no later than 60 days after determining a breach occurred. Attorney general: breaches affecting 250 or more Texans, as soon as practicable but no later than 30 days after determining the breach occurred, filed electronically since September 1, 2023.

• New York — General Business Law § 899-aa. Individuals: most expedient time possible and without unreasonable delay, but no later than 30 days after discovery. Attorney general, the Department of State and the Division of State Police: notified whenever any New York resident is notified, no minimum count; consumer reporting agencies must also be told if more than 5,000 residents are notified at one time.

• Massachusetts — M.G.L. c. 93H § 3. No fixed day-count for either individuals or the attorney general: both get notice as soon as practicable and without unreasonable delay. The attorney general and the director of consumer affairs and business regulation are both required recipients, with no minimum resident count stated.

• Washington — RCW 19.255.010. Individuals: most expedient time possible, without unreasonable delay, and no more than 30 calendar days after discovery. Attorney general: above 500 Washington residents affected, no more than 30 days after discovery.

• Virginia — Code of Virginia § 18.2-186.6. Individuals and the Office of the Attorney General are notified together, without unreasonable delay, with no fixed day-count and no minimum resident count stated in the text for either recipient.

• Ohio — Revised Code § 1349.19. Individuals: most expedient time possible, not later than 45 days following discovery or notification of the breach. No attorney-general notice requirement in the statute at all; nationwide consumer reporting agencies must be told, without unreasonable delay, only above 1,000 Ohio residents affected.

• Colorado — Revised Statutes § 6-1-716 (2023 printout). Individuals: most expedient time possible and without unreasonable delay, but not later than 30 days after determination that a breach occurred. Attorney general: above 500 Colorado residents affected, same 30-day outer limit; consumer reporting agencies must also be told above 1,000 residents.

• North Carolina — General Statute § 75-65. Individuals: without unreasonable delay following discovery, no fixed day-count. Attorney general and consumer reporting agencies: only triggered if the business notifies more than 1,000 persons at one time, also without unreasonable delay. The statute requires the notice itself to include the Federal Trade Commission's and the North Carolina Attorney General's own contact information, regardless of the 1,000-person threshold.

• Minnesota — Minnesota Statutes § 325E.61. Individuals: most expedient time possible and without unreasonable delay, no fixed day-count; a business that only maintains data it doesn't own must notify the data's owner immediately. Consumer reporting agencies: above 500 persons notified at one time, within 48 hours — the fastest third-party clock in this guide. No attorney-general pre-notice duty found in the subdivisions read this run (1 through 4 and 6); subdivision 5 was renumbered into Minnesota Statutes § 13.055 and not read.

• Maryland — Commercial Law Article § 14-3504. Individuals: as soon as reasonably practicable, not later than 45 days after the business discovers the breach. Attorney general: notified before the business may notify individuals, with no minimum resident count — the only one of the twelve states requiring attorney-general notice to come first. No requirement to notify consumer reporting agencies directly; the statute only requires the individual notice itself to list their toll-free numbers.

• Arizona — Arizona Revised Statutes § 18-552. Individuals: within 45 days after the breach is determined to have occurred. Attorney general and consumer reporting agencies: both triggered together, only if the breach requires notifying more than 1,000 individuals — the same notification-size threshold North Carolina uses, rather than a state-residency count.

These state statutes govern notice to individuals and, in most of the twelve, to a state attorney general. They are a separate legal track from the federal securities-disclosure clock this site's Item 1.05 guide covers: a public company can owe both at once, from the same breach, on different deadlines.

What should a company operating in more than one state do with this?

Build a compliance calendar around the shortest applicable deadline, not an average of them. A breach affecting residents of Texas, Washington and Ohio at once has to meet Washington's 30-day individual-notice clock even though Texas allows 60 and Ohio allows 45, because each state's own law applies independently to its own residents, and nothing in any of these twelve statutes extends one state's deadline to match another's. The same logic applies to attorney-general notice: New York, Massachusetts and Maryland require it regardless of how few residents are affected (Maryland even before individuals are told), so a breach too small to trigger California's, Washington's or Colorado's 500-resident threshold can still require an attorney-general filing in those three states, and a breach notifying fewer than 1,000 total people never triggers North Carolina's or Arizona's attorney-general duty at all, no matter how it's split among residents.

Where does this guide go from here?

This is a second batch of four added to the original eight, chosen for site accessibility under this network's required User-Agent, not a ranking. Dropped from this run's attempt: Michigan's and Illinois's own legislature sites presented broken or self-signed TLS certificate chains on every official path tried (the same kind of server-side block this network has documented for other government sources, not a User-Agent rejection); Wisconsin's official statutes site could not be reached at all this run; Tennessee and Georgia were not checked against their own official legislature sites this run, only a secondary mirror that returned an error, so they remain genuinely unchecked rather than confirmed blocked. A future update should keep adding states the same way — directly from the state's own statute or attorney general guidance, not a secondary summary — revisit California once its own statute text can be confirmed from a source this network's required User-Agent can reach, and give Michigan, Illinois, Wisconsin, Tennessee and Georgia a proper attempt against their own official sites.