Security breach notification (businesses)

Requires notice to California residents when their unencrypted personal information (or encrypted data with a compromised key) is, or is reasonably believed to have been, acquired by an unauthorized person. SB 446 (2025) added a firm 30-calendar-day deadline from January 1, 2026.