Breach-notification timelines

The two states record different dates, so their numbers are shown side by side and never combined.

• Washington records the date the organisation says it became aware of the breach and the date it notified the Attorney General. The delay is the days between them, which is the clock the statute uses: notice to the AG is due no more than 45 days after discovery before 1 March 2020 and 30 days after that (RCW 19.255.010). The law allows a delay requested by law enforcement, and “aware” is the organisation's own date, so a notice past the deadline is not by itself a violation. Washington only requires notice to the AG when more than 500 residents are affected.
• California records only the dates of the breach and the date the notice was posted. The delay is the days from the last listed breach date to the report. It includes the time taken to discover the breach, so it is longer than the legal clock and is not a measure of compliance. Notices that list no breach date are counted but left out of the delay figures.

Years are calendar years of the report date (Washington's own annual report runs from 24 July). Medians and percentiles use linear interpolation. Negative delays, which come from data-entry errors, are left out. The current year is partial.