California's New 30-Day Data Breach Notification Deadline: What SB 446 Means for Merchants

How many days do you have to notify customers after a data breach in California?

Thirty calendar days. As of January 1, 2026, California’s SB 446 requires any business that owns or licenses computerized personal information on California residents to notify those residents within 30 calendar days of discovering or being told about a breach. If your point of sale, online ordering system, or loyalty program ever gets compromised, that clock starts running the day you find out, not the day you get around to dealing with it.

What was the rule before this?

For two decades, California’s breach notification law (Civil Code 1798.82) just said notice had to go out “in the most expedient time possible and without unreasonable delay.” That phrase gave businesses room to argue about what counted as reasonable, and some took weeks or months while lawyers and forensics firms worked through the details. SB 446, signed in October 2025, replaces that vague standard with a hard number. Thirty days is now the ceiling, not a guideline.

Does this apply to a restaurant or small retail shop?

Yes, if you collect and store personal information on customers and you do business in California, which covers almost every merchant reading this. It doesn’t matter whether you’re a five-location taco chain or a single hardware store. The law applies to anyone who owns or licenses computerized data containing personal information, meaning names paired with things like a driver’s license number, account number, or payment card number along with the code needed to access it. A loyalty program with saved birthdays and phone numbers counts. An online ordering platform that stores delivery addresses and partial card data counts. A catering business that keeps a spreadsheet of client contact info and invoice history counts too.

If you use a third party, like a POS provider or online ordering vendor, to hold that data on your behalf, the rules split slightly: the company that merely maintains the data (but doesn’t own it) has to notify you, the business that owns the customer relationship, immediately upon discovering a breach, so you can meet your own 30-day clock to the end customer. That’s worth confirming with any vendor you use for payments, invoicing, or online ordering before you ever need it.

When do you also have to tell the California Attorney General?

If a breach affects 500 or more California residents, you have to send a sample copy of the notice you’re sending customers to the state Attorney General, and you have 15 days from when you notify those residents to do it. That’s a separate, shorter clock that runs after the consumer notices go out, not instead of them. A single-location restaurant with a breached loyalty database of 300 members wouldn’t trigger the AG notice. A regional chain or an e-commerce operation with a bigger customer list likely would.

What does the notice actually have to say?

SB 446 also locks in a required format for the notice itself, with specific headings: what happened, what information was involved, what the business is doing about it, and what the recipient can do to protect themselves. If you’ve ever gotten one of these letters in the mail from a retailer, you’ve seen the format already. Plain language, no legal hedging, laid out so a customer can skim it and know whether they need to act.

Are there any exceptions to the 30-day deadline?

Two. You can delay notice if law enforcement asks you to, in writing, because an active investigation would be compromised by early disclosure. You can also delay to the extent necessary to determine the scope of the breach and restore reasonable integrity to your systems, meaning you don’t have to notify people about a breach you haven’t fully figured out yet. But both exceptions require documentation, and neither is a blank check. If your forensics team is still working on day 25, you’d better have notes showing why.

A simple timeline, with real numbers

Say a breach happens on March 1 and your POS vendor flags it on March 5. Here’s how the clock could run:

Day	What happens
March 5	You’re notified of the breach (clock starts)
March 5-20	Forensics work: determine what data was exposed, how many customers affected
March 25	Notices drafted, reviewed, mailed or emailed to affected customers
April 4 (Day 30)	Deadline for customer notice
April 9 (15 days after customer notice, if 500+ residents affected)	Sample notice due to the Attorney General

That’s a tight window once you account for figuring out what actually happened. Fifteen days of forensics and ten days to draft, review, and send notices doesn’t leave much slack, especially for a small business without an in-house legal or IT security team.

What should you do before you ever need this?

A few things worth doing now rather than after an incident:

• Know what personal data your POS, online ordering, and loyalty systems actually store, and where.
• Ask your payment processor and POS vendor, in writing, what their breach notification timeline to you is. If they take two weeks to tell you, your 30-day clock is already half gone.
• Keep a short written incident response plan, even a one-page version, naming who calls the vendor, who drafts the notice, and who decides when to call a lawyer.
• Use tokenized payment processing and EMV chip or tap-to-pay hardware where you can, so a breach of your systems doesn’t also mean a breach of raw card numbers. Modern terminals and invoicing tools that never store full card data in the clear reduce both your risk and your reporting burden if something does go wrong.

This is general information about a California law, not legal advice. If you’ve had a breach or think you might have one, talk to an attorney who handles data privacy before your notices go out, since the exact facts of an incident change what’s required.

Sources:

• Daily Journal, “California data breach law tightens with 30-day deadline, raises stakes for companies”
• Fisher Phillips, “California Likely to Soon Require Data Breach Notifications to Be Provided to Consumers Within 30 Days”
• Pillsbury Law, “California Data Breach Notification Requirements”
• MVA Law, “California Amends Data Breach Notification Requirements”
• California Civil Code Section 1798.82 (california.public.law)