California businesses that experience a data security incident now face a defined 30-day notification deadline under SB 446, a meaningful change from the prior standard, which required notice only “in the most expedient time possible and without unreasonable delay.” The shift from a flexible standard to a hard deadline changes how the first 72 hours of an incident response should be structured, and it raises the stakes for organizations that have not run a breach response before.

Why the Change Matters

Under the prior rule, a business had a defensible argument for taking additional time if the delay was reasonable under the circumstances, for example while working with forensic investigators to determine scope or coordinating with law enforcement. A fixed 30-day clock narrows that flexibility considerably. Businesses now need to treat the determination of whether a reportable breach occurred, and the drafting of notification letters, as parallel workstreams from day one, rather than sequential ones.

The Overlay Problem

Very few incidents are governed by California law alone. A single breach involving health information, financial account data, payment card data, or information about minors can implicate HIPAA, the Gramm-Leach-Bliley Act, PCI DSS, SEC cybersecurity disclosure rules, COPPA, and FERPA simultaneously, each with its own timing requirements, notice content requirements, and regulator contacts. Mapping these overlays at the outset, rather than discovering a shorter deadline midway through drafting the California notice, is one of the most common points of delay we see in live incidents.

Attorney General Notification Thresholds

Businesses should also confirm, early in the response, whether the incident crosses the threshold requiring notice to the California Attorney General, since that filing has its own content requirements and a copy of the consumer notice must typically be submitted alongside it. Treating the AG notification as an afterthought once consumer letters are finalized is a common source of last-minute scrambling.

Practical Steps for the First 72 Hours

• Engage forensic and legal counsel simultaneously, under privilege, rather than sequentially.
• Identify every category of data potentially involved before finalizing a notification strategy, since each category may trigger a different regulatory overlay.
• Confirm insurance carrier notification requirements, which often have their own short deadlines separate from statutory ones.
• Build the notification timeline backward from the 30-day deadline immediately, rather than after root cause is fully understood.
• Consider whether the facts warrant referral or co-counsel support in jurisdictions with additional or conflicting requirements.

The Takeaway

SB 446 rewards organizations that already have an incident response plan mapped to a hard deadline, and penalizes those that assume they will have the same flexibility they had in prior years. Businesses that have not stress-tested their breach response plan against a firm 30-day clock should do so before an actual incident forces the issue.

This post is intended for general informational purposes and does not constitute legal advice. If your organization is responding to an actual incident, please contact Jeffrey R. Glassman in our Privacy and Data Compliance group immediately.