California businesses now have 30 calendar days to notify residents after discovering a data breach, then 15 more to send the Attorney General a sample copy of that notice if it affected over 500 Californians. Senate Bill 446 wrote that clock into Civil Code 1798.82 on October 3, 2025, and it took effect January 1, 2026. The Attorney General's own breach database, the one businesses file into, tells a less reassuring story about where companies are starting from: among the 404 breach notices reported so far in 2026, the median gap between the breach itself and the report reaching the state was 137 days, more than four times the new 45-day floor.
What SB 446 actually changed
Before SB 446, Civil Code 1798.82 already required notifying affected residents "in the most expedient time possible and without unreasonable delay," a standard with no number attached to it. SB 446 replaced the vague language with a hard deadline: notification to residents within 30 calendar days of discovering or being notified of the breach, with narrow exceptions to accommodate a law enforcement investigation or to determine the scope of the breach and restore the system's integrity. It also added something the old statute never specified for the state-facing side: a business that has to notify more than 500 California residents must submit a sample of that notice to the Attorney General within 15 calendar days of notifying those residents. Stack the two deadlines and a compliant business has, at most, 45 days from discovery to a filing showing up in the state's public database.
Who this actually reaches
This isn't the ADMT rulemaking covered elsewhere on this site, and it doesn't share that rule's revenue floor. Civil Code 1798.82 applies to "an individual or business that conducts business in California, and that owns or licenses computerized data that includes personal information," full stop. There's no $26.6 million threshold, the same one that gates the CCPA's cybersecurity audit requirement, no employee-count test, no carve-out for a five-person startup. "Personal information" includes the obvious fields (Social Security numbers, driver's license numbers, financial account numbers, medical and health-insurance information, biometric data) and one that catches software companies specifically: a username or email address combined with the password or security question that unlocks the account. Any SaaS product storing customer login credentials is holding data this statute cares about, whether or not the company is anywhere near CCPA's size threshold.
What the state's own numbers show
The Attorney General's breach database lists every sample notice a business has filed since the reporting requirement began, searchable by organization and date, and downloadable as a full CSV. Of the 404 notices with a reported date in 2026 (through September 21), 376 list a usable breach date. Measuring from the end of the stated breach window to the date the notice reached the Attorney General:
| Time from breach to state filing | Share of 2026 notices |
|---|---|
| 30 days or less | 5.6% |
| 45 days or less | 12.8% |
| 60 days or less | 18.4% |
| 90 days or less | 32.2% |
| 180 days or less | 59.3% |
| Over 365 days | 13.6% |
The median across all 376 was 137 days. The mean, pulled upward by a long tail (the slowest filing took 892 days), was 188.
One caveat matters more than the headline number: the database's "date of breach" is the incident window a company later determined, most often the end of unauthorized access, not necessarily the day anyone at the company found out about it. SB 446's clock starts at discovery, not at the breach itself. So this 137-day figure isn't a direct measurement of the 30-day rule being broken; it's a measurement of the whole pipeline, from compromise to public filing, of which the new law only regulates the last 45 days. That's not a reason to read past the number. It's the actual point: for most companies in this dataset, the newly-regulated stretch is the smaller part of a much longer problem.
Where the time actually goes
Only 5.6% of 2026 filings landed inside 30 days total, and the fastest a fully compliant business can move from breach to state filing is 45 days: 30 to notify residents plus 15 more to notify the Attorney General. A filing under 30 days total is only possible when discovery happens on, or very near, the last day of unauthorized access. That almost never happens by design. It happens because most breaches aren't caught while they're occurring, they're caught afterward, by a customer complaint, a security researcher, a ransomware note, or a routine audit that stumbles onto something. The gap between when access happened and when anyone noticed is dwell time, and it's the part SB 446 doesn't touch at all. It's also, per this dataset, the larger part of the 137-day median by a wide margin: even a generous discovery-to-filing estimate of 45 days leaves roughly 90 days unaccounted for in the typical case.
A worked example
Picture a 60-person mid-market employer running a customer portal with saved payment methods and a login system, the kind of business that isn't gated by any CCPA revenue threshold but is squarely covered by 1798.82. A support ticket in March flags "weird activity" on a handful of accounts; it gets closed as user error because nobody correlates it against anything else. In June, a security vendor doing routine scanning finds credentials from the portal for sale, and that's when the company actually learns it had a breach, three months after the access happened and with no internal log precise enough to say exactly when it started. From that June discovery date, the 30-day and 15-day clocks both start ticking on time and the company hits both deadlines cleanly. The Attorney General's database will still show a gap of well over 100 days from the breach window to the filing, and a regulator or a plaintiff's attorney reading that gap won't credit the company for meeting a clock that started three months late.
What this means for your engineering team
The 45-day statutory floor is the easy part to build for: a notification template, a legal review step, a filing checklist. The part this data says most companies are actually failing at is upstream of the law, in the logging, access monitoring and anomaly detection that determines how long unauthorized access runs before anyone notices it. That's an engineering investment, not a compliance one, and it's the same infrastructure this site has argued for on the ADMT side: a business that already built an audit trail for its automated decisions or tightened phishing-resistant MFA on the accounts that touch personal information is closer to catching a breach in days rather than months, because the same access logs that support one compliance obligation shorten discovery time for the other. It's a weaker fit if a company's detection is already fast and the gap is procedural, a notification template that takes legal three weeks to approve internally. That's a process fix, not a build, and no amount of logging infrastructure solves a slow sign-off chain.
If your team doesn't know today how long it would take to notice unauthorized access to a system holding customer credentials or account data, that's the honest starting point, before the notification template matters at all. Tell us what your logging and access-monitoring setup actually looks like and we'll tell you where the detection gap probably sits, or if the more pressing question is the automated-decision side of these same regulations, that's a related but separate scoping conversation. Either way, get in touch and we'll give you a straight read on what's actually missing.
Sources
- California Legislature: SB 446, Data breaches: customer notification, Chapter 319, Statutes of 2025, approved and filed October 3, 2025
- California Legislative Information: Civil Code Section 1798.82, current text as amended
- California Department of Justice, Office of the Attorney General: Search Data Security Breaches, full CSV export accessed September 21, 2026 (404 notices with a reported date in 2026)