State Data Breach Notification Deadlines: The 30-Day, 45-Day, and 60-Day Notice Clocks

COMPLIANCE GUIDE
October 11, 2026

State data breach notification rules use different triggering events, deadlines, notice contents, and regulator-reporting thresholds. A defensible process identifies the applicable jurisdiction, starts the correct clock, prepares the required notice, and preserves the decision record.

State notice deadlines use different clocks

All 50 states, the District of Columbia, and three U.S. territories have enacted data breach notification laws, as compiled by the National Conference of State Legislatures.

The Privacy Rights Clearinghouse’s 2026 50-state survey reports that consumer-notice deadlines cluster around 30, 45, and 60 days. Other states require notice without unreasonable delay. These are industry-reported groupings, not a regulatory finding or a substitute for the statute. Verify the current state notice requirements in every applicable jurisdiction.

A numeric deadline does not identify its own starting point. One statute can measure from discovery, while another measures from a determination that a breach occurred. Record both events and apply the trigger established by the governing law.

Three state examples show why the trigger matters

Washington: discovery date

Under Washington RCW 19.255.010(8), consumer notice must be provided in the most expedient time possible, without unreasonable delay, and no later than 30 calendar days after the breach was discovered. Statutory exceptions allow delay at law enforcement’s request or when necessary to determine the breach’s scope and restore the reasonable integrity of the data system.

Colorado: determination date

Under Colorado C.R.S. 6-1-716(2)(a), notice must be provided in the most expedient time possible and without unreasonable delay, but no later than 30 days after the date the entity determines that a security breach occurred. The discovery date and the determination date should not be treated as interchangeable.

New York: discovery date

Under New York General Business Law § 899-aa(2), disclosure must be made in the most expedient time possible and without unreasonable delay, and within 30 days after discovery, except for the legitimate needs of law enforcement.

These examples illustrate why a deadline calendar should capture the statutory trigger as well as the final date. A state law tracker can help organize jurisdiction, triggering event, recipient, calculation method, and review ownership.

What consumer notices must contain

Notice requirements by state differ. The following statutory examples show the content and method controls that a notice review should test.

Washington

Washington consumer notices must use plain language and include:

• The reporting business’s name and contact information.
• The types of personal information involved.
• The exposure time frame, if known, including the breach date and discovery date.
• Toll-free numbers and addresses for major credit reporting agencies if personal information was exposed.

Colorado

Colorado notices must include:

• The breach date, estimated date, or estimated date range.
• A description of the personal information acquired or reasonably believed to have been acquired.
• Contact information for the covered entity.
• Toll-free numbers, addresses, and websites for consumer reporting agencies.
• The Federal Trade Commission’s toll-free number, address, and website.
• A statement that the resident can obtain information about fraud alerts and security freezes from the FTC and consumer reporting agencies.

New York

New York notices must include the notifying party’s contact information, telephone numbers and websites for relevant state and federal agencies that provide breach-response and identity-theft-prevention information, and a description of the categories of information accessed or acquired. The notice must specify which elements of personal information and private information were involved.

A controlled content review should compare the final notice against the applicable statutory notice requirements. Preserve the approved content version and the recipient scope used for distribution.

Regulator filings have separate thresholds

Consumer notification and regulator reporting are separate obligations. Resident-count thresholds can trigger additional notices, and those filings may have their own content and timing controls.

• Washington: If more than 500 Washington residents must be notified from a single breach, the business must notify the attorney general no more than 30 days after discovery. The filing must include the affected-consumer count or estimate, information types involved, exposure time frame including breach and discovery dates, containment steps, and one sample notice with personally identifiable information excluded. Update the filing if information was unknown when it was due.
• Colorado: If 500 or more Colorado residents are reasonably believed affected, the attorney general must be notified no later than 30 days after the determination date. If more than 1,000 residents must be notified, nationwide consumer reporting agencies must also be notified.
• New York: When New York residents are to be notified, the business must notify the attorney general, department of state, division of state police, and department of financial services about notice timing, content, distribution, and the approximate number affected, and provide a copy of the notice template. The department of financial services requirement applies only to covered entities under 23 NYCRR 500.1, filed in compliance with 23 NYCRR 500.17. If more than 5,000 New York residents are notified at one time, consumer reporting agencies must also be notified.

The reporting thresholds are not uniform. Document the population-count method, the threshold applied, and the basis for any estimate.

Notice methods require their own review

Colorado permits written notice to the postal address in the entity’s records, telephone notice, and electronic notice when electronic communication is a primary means of communication or when the method is consistent with the E-SIGN Act. Substitute notice is available when cost exceeds $250,000, the affected class exceeds 250,000 Colorado residents, or contact information is insufficient. It consists of email notice, conspicuous website posting, and notification to major statewide media.

New York permits written notice, electronic notice with the recipient’s express consent and a log of each notification, and telephone notification with a log. Consent cannot be required as a condition of a business relationship or transaction. Substitute notice is available when cost exceeds $250,000, the affected class exceeds 500,000, or contact information is insufficient.

The applicable statute determines the permitted method. Electronic delivery does not automatically satisfy every notice requirement. Review the consent, recipient, and evidence controls for the relevant process in the electronic notices guidance. Certified Mail is not a blanket requirement under the provisions summarized here. Where it is separately selected and permitted, retain the mailing and delivery evidence; Certified Mail Labels can support that workflow.

Document the decision sequence

A defensible breach-notice record lets reviewers reconstruct how the organization identified the rule, calculated the deadline, and completed each required action.

Record and retain:

1. Discovery date: The event and evidence supporting when the breach was discovered.
2. Determination date: The decision that a security breach occurred, including the decision owner and supporting record.
3. Count methodology: The affected-resident count or estimate, jurisdiction, data sources, assumptions, and any later reconciliation.
4. Notice content version: The approved template, final notice, required content checks, and the version distributed.
5. Regulator filings: Recipient, submission date, filing copy, supporting materials, and any required update.
6. Exception decisions: The exception relied on, supporting facts, approval, review date, and the action taken when the exception ended.

Also connect recipient lists, delivery records, failed or returned notices, approvals, and corrective actions to the incident record. Where Certified Mail is used, keep its mailing evidence linked to the corresponding notice rather than as an unrelated postal record.

Apply notice record retention controls

Notice record retention should follow the schedule applicable to the notice, incident, and underlying matter. There is no single retention period established here for every breach-notice record. Define the retention trigger, record owner, access permissions, legal-hold process, and authorized disposition steps.

Preserve original and updated notice versions, regulator correspondence, count calculations, and exception records without overwriting the historical decision trail. A documented retention process helps maintain accurate, reviewable evidence for oversight. See the notice record retention guide for related controls.

A consistent process establishes the applicable rule, verifies the trigger, calculates each deadline, completes required notices and filings, and preserves the supporting record. National Compliance Registry’s services support ownership and maintenance of compliance obligations and records.

General compliance information, not legal advice.