State Data Breach Notification Laws: 2026 Changes You Need to Know
If you handle personal data in the United States, you’re not dealing with one data breach law; you’re dealing with 50, plus the District of Columbia and several territories. As of 2026, there are new State Data Breach Notification Laws available.
There’s still no single federal breach notification statute, so every company operating across state lines has to comply with a shifting patchwork of timelines, definitions, and regulatory notice requirements. And in 2026, that patchwork is shifting quite a bit.
The Trend Everyone’s Watching: Faster Deadlines
For years, most states used vague language like “the most expedient time possible and without unreasonable delay” instead of a hard deadline. That’s starting to change.
California’s SB 446, effective January 1, 2026, replaced that flexible standard with an actual number: businesses now have 30 calendar days from discovering or being informed of a breach to notify affected residents, and only 15 calendar days after that to send a copy of the notice to the state Attorney General if 500 or more residents are affected.
New York shortened its own reporting window earlier in 2025 as well. Roughly 20 states now specify a numeric deadline, most falling between 30 and 60 days, while the remaining states still rely on the older “without unreasonable delay” standard.
That split matters operationally. A company with customers in California and, say, Ohio can no longer use one internal SLA for breach response and call it compliant everywhere.
Oklahoma Finally Catches Up
Oklahoma hadn’t touched its breach notification law since it was first enacted in 2008. That changed with SB 626, effective January 1, 2026, which:
- Broadens what counts as personal information: to include government-issued ID numbers, unique electronic identifiers, and biometric data (fingerprints, iris scans, and similar)
- Adds a regulator notice requirement: Entities must now notify the state Attorney General within 60 days of individual notice if 500 or more residents are affected
- Updates safe-harbour exemptions: Largely without narrowing them, but makes all exemptions subject to that same AG notice trigger
It’s a smaller state getting in line with what’s become a fairly standard template elsewhere: broader data definitions, a regulator notice tier tied to a numeric threshold, and safe harbors that don’t let companies skip regulator disclosure entirely.
Comprehensive Privacy Laws Are Quietly Expanding Security Obligations Too
Breach notification statutes aren’t the only place these obligations live anymore. States rolling out comprehensive consumer privacy laws include:
- Delaware
- Iowa
- Nebraska
- New Hampshire
- Minnesota
- Tennessee
- New Jersey
- Maryland
- Indiana
- Kentucky
- Rhode Island
These states are building general security requirements directly into their statutes, often with heightened standards for sensitive categories of data. For compliance teams, that means the breach notification chart is no longer the whole picture; it has to be read alongside each state’s broader privacy law.
What This Looks Like When It Goes Wrong
The shift toward firm deadlines isn’t just theoretical. A recent case out of Colorado, Carey v. Clarity Telecom, LLC d/b/a Bluepeak (filed May 2026), illustrates the exposure companies now face.
The complaint alleges the telecom discovered a cybersecurity incident in December 2025 but didn’t begin notifying customers until May 2026: a gap that’s now central to the lawsuit. As one industry commentary framed it, the operative question in breach litigation is shifting from just “why did this happen” to “why did it take so long to tell us.”
Investigation still takes time, and the law doesn’t expect omniscience, but it does expect a documented, reasonable process and a notice that goes out promptly once the facts are known, not once every question is answered.
The Practical Takeaway
For businesses and the lawyers and compliance professionals advising them, three things stand out heading into the rest of 2026:
- Map your actual footprint against actual deadlines: “Without unreasonable delay” and “30 days” are not interchangeable promises, and an incident response plan built around the loosest standard will fail in the states that have tightened theirs.
- Check the regulator-notice thresholds separately from the consumer-notice ones: States are increasingly layering AG or regulator notification on top of consumer notification, often with its own clock that starts running after consumer notice goes out, as in both the California and Oklahoma changes.
- Don’t treat the breach notification chart as the whole compliance picture: With more states layering security obligations into comprehensive privacy statutes, a breach response plan built only around the notification statute may miss obligations that now live elsewhere in the code.
The core problem, a 50-state patchwork with no federal floor, isn’t going away. But the direction of travel is fairly consistent: shorter clocks, broader data definitions, and more regulator visibility into what used to be handled quietly between a company and its affected customers.
Legal References
- California — Cal. Civ. Code § 1798.82, as amended by SB 446 (2025), effective January 1, 2026
- Oklahoma — Security Breach Notification Act, as amended by SB 626 (2025), effective January 1, 2026
- Texas — Tex. Bus. & Com. Code § 521.053
- New York — General Business Law § 899-aa, as amended (2025 shortened reporting window)
- Carey v. Clarity Telecom, LLC d/b/a Bluepeak, No. 1:26-cv-02251 (D. Colo. filed May 22, 2026)
- Perkins Coie, Security Breach Notification Chart (revised September 2025) — comprehensive 50-state reference
- Perkins Coie, 2025 Breach Notification Law Update
- State comprehensive privacy laws referenced as adding security obligations (effective 2025–2026): Delaware, Iowa, Nebraska, New Hampshire, Minnesota, Tennessee, New Jersey, Maryland, Indiana, Kentucky, Rhode Island.
This post is for general informational purposes and isn’t legal advice. If you’re building or updating an incident response plan, consult counsel licensed in the relevant states. Requirements here change frequently, and the details matter.
