--- title: "Keep the US breach notice laws as data ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws id: CMP-61 level: Recommended region: US updated: 2026-10-27 build: a2a6bdfed830 tokens: 1433 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Keep the US breach notice laws as data For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-61 - Level: Recommended - Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md) - Rule: Keep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it. - Check: A unit test feeds a breach with people in Colorado and California into the tool. It shows the 30-day Colorado deadline. It adds the California attorney general step, due 15 days after the notice to people, once California residents pass 500. - Region: United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: Every US state has a breach notice law, and the state of residence of each affected person decides which ones apply. Many say "without unreasonable delay", and some set a limit in days. Examples are 30 days in California, Colorado, Florida and Washington. Some also require a notice to the attorney general above a number of residents. California asks for it above 500 residents, within 15 days of telling the people. Count affected people per state from your data, then feed the deadlines into the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md). A listed company may also owe the SEC a Form 8-K within four business days after it decides an incident is material. Add them to the [plan for a data breach](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### JavaScript example ```js const DAY_MS = 86_400_000; const STATE_BREACH_LAWS = { CO: { days: 30, regulatorFrom: 500 }, FL: { days: 30, regulatorFrom: 500 }, WA: { days: 30, regulatorFrom: 501 }, CA: { days: 30, regulatorFrom: 501, regulatorDaysAfterNotice: 15 }, }; const addDays = (date, days) => new Date(date.getTime() + days * DAY_MS); export const stateBreachSteps = (discoveredAt, residentsByState) => Object.entries(residentsByState).flatMap(([state, count]) => { const law = STATE_BREACH_LAWS[state]; if (!law) return [{ state, step: 'look up this state before you send anything' }]; const due = addDays(discoveredAt, law.days); const regulatorDue = addDays(due, law.regulatorDaysAfterNotice ?? 0); return [{ state, step: 'notify people', due }, ...(count >= law.regulatorFrom ? [{ state, step: 'notify the attorney general', due: regulatorDue }] : [])]; }); ``` ### Python example ```python from datetime import datetime, timedelta STATE_BREACH_LAWS = { "CO": {"days": 30, "regulator_from": 500}, "FL": {"days": 30, "regulator_from": 500}, "WA": {"days": 30, "regulator_from": 501}, "CA": {"days": 30, "regulator_from": 501, "regulator_days_after_notice": 15}, } def state_breach_steps(discovered_at: datetime, residents_by_state: dict[str, int]) -> list[dict]: steps = [] for state, count in residents_by_state.items(): law = STATE_BREACH_LAWS.get(state) if law is None: steps.append({"state": state, "step": "look up this state before you send anything"}) continue due = discovered_at + timedelta(days=law["days"]) steps.append({"state": state, "step": "notify people", "due": due}) if count >= law["regulator_from"]: regulator_due = due + timedelta(days=law.get("regulator_days_after_notice", 0)) steps.append({"state": state, "step": "notify the attorney general", "due": regulator_due}) return steps ``` ## Sources - [California Attorney General on data breach reporting](https://oag.ca.gov/privacy/databreach/reporting) - [California Civil Code section 1798.82](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82) ## Related rules - CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance - CMP-71 [Plan for a data breach](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan.md) in Compliance and governance - CMP-77 [Report health data leaks under the FTC rule when HIPAA does not cover you](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments.md) - Next: [Give notice and an appeal before automated decisions](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights.md) - [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)