Washington Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Washington businesses must notify affected consumers within 30 days of discovering a data breach under RCW 19.255.010, and must also notify the Attorney General when a single breach requires notifying more than 500 Washington residents. The deadline applies regardless of business size, and the clock starts on the date of discovery, not when the breach occurred.

Washington state has one of the most comprehensive data breach notification laws in the United States. Its 30-day notification deadline is among the shortest nationally, its definition of personal information is among the broadest, and it is one of the few states where individual consumers have a private right of action to sue for notification violations.

The core statute for private entities is RCW 19.255.010. A parallel statute, RCW 42.56.590, governs state and local government agencies. The law was originally enacted in 2005 and was significantly strengthened by HB 1071, signed by Governor Jay Inslee on May 7, 2019, with the new requirements taking effect March 1, 2020.

For a broader look at Washington's privacy framework, see the parent guide to Washington Data Privacy Laws.

Who Must Comply

Washington's breach notification law applies to any person or business that conducts business in the state and owns or licenses computerized data that includes personal information about Washington residents.

There is no minimum size threshold. Any business, regardless of size, that handles personal information of Washington residents must comply.

Government agencies at the state and local level are covered under the separate statute RCW 42.56.590, which imposes substantially similar obligations.

Third-party service providers that maintain data on behalf of another business must notify the data owner or licensee immediately following discovery of a breach. The data owner then bears responsibility for consumer and AG notification.

What Qualifies as Personal Information

Washington's definition of personal information is among the broadest in the country. Under RCW 19.255.005, the definition has three separate branches, and only the first of them requires the resident's name.

Branch one: a name plus a data element. A resident's first name or first initial and last name in combination with any one or more of the following:

• Social Security number
• Driver's license number or Washington identification card number
• Account number or credit or debit card number, combined with any required security code, access code, or password that would permit access to a financial account, or any other numbers or information that can be used to access a financial account
• Full date of birth
• Private key that is unique to an individual and used to authenticate or sign an electronic record
• Student, military, or passport identification number
• Health insurance policy number or health insurance identification number
• Any information about a consumer's medical history or mental or physical condition, or about a health care professional's medical diagnosis or treatment of the consumer
• Biometric data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns used to identify a specific individual

Branch two: account credentials, with no name required. A user name or email address in combination with a password or security questions and answers that would permit access to an online account is personal information on its own. The resident's name does not have to be part of the breached data.

Branch three: those same data elements without a name. Any of the branch-one data elements, or any combination of them, without the consumer's first name or first initial and last name, if encryption, redaction, or other methods have not rendered them unusable and they would enable a person to commit identity theft against the consumer.

The inclusion of date of birth, student, military and passport ID numbers, health insurance information, and medical history makes Washington's list of data elements substantially broader than most states, and branches two and three widen the law further by dropping the name requirement that most state breach statutes treat as mandatory. The 2019 amendments through HB 1071 added several of these categories.

Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

What Triggers the Notification Requirement

A breach of the security system under Washington law is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the entity.

Three conditions must be met for notification to be required:

1. Personal information was, or is reasonably believed to have been, acquired by an unauthorized person
2. The personal information was not secured (i.e., not encrypted or otherwise rendered unusable)
3. The breach is reasonably likely to subject consumers to a risk of harm

The risk-of-harm analysis gives entities some discretion, but the standard is whether harm is "reasonably likely," not whether it has already occurred. Good-faith acquisition of personal information by an employee or agent of the entity does not constitute a breach, provided the information is not used or disclosed in an unauthorized manner.

The 30-Day Notification Deadline

Washington requires notification in the most expedient time possible and without unreasonable delay, but no later than 30 days after the breach was discovered.

This 30-day deadline, introduced by HB 1071, is one of the shortest in the country. Before the 2019 amendments, the deadline was 45 days.

The clock starts from the date the breach was discovered, not from the date the breach itself occurred. However, organizations should not delay their investigation as a means of avoiding the timeline.

Law enforcement may request a delay in notification if it would impede a criminal investigation. The entity must provide notification promptly after law enforcement determines notification will no longer compromise the investigation.

What the Consumer Notice Must Include

Washington law specifies required content for breach notification letters. Under RCW 19.255.010(6)(b), the notice must include all four of the following:

• The name and contact information of the reporting person or business
• A list of the types of personal information that were or are reasonably believed to have been the subject of the breach
• A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach
• The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed personal information

The credit reporting agency item is not limited to financial data or Social Security numbers. The statute conditions it on the breach having exposed personal information, which is the same condition that requires the notice in the first place, so in practice it belongs in every consumer notice.

The notice must be written in plain language. Beyond those four required items, entities are encouraged, though not strictly required, to also include a description of the incident, steps taken to address the breach, and recommendations for consumers to protect themselves.

Attorney General Notification

When a breach affects more than 500 Washington residents, the entity must notify the Washington Attorney General's office within the same 30-day window.

The AG notification is submitted via an online Data Breach Notification Web Form. The notice must include:

• The number of Washington consumers affected or potentially affected
• A list of the types of personal information breached
• The time frame of exposure (if known)
• A summary of steps taken to contain the breach
• A sample copy of the security breach notification sent to consumers

The AG's office maintains a public Data Breach Notifications Directory on its website, listing all reported breaches.

Substitute Notice

Washington allows substitute notice when direct notification is not feasible. An entity may use substitute notice if:

• The cost of providing direct notice would exceed $250,000
• The affected class exceeds 500,000 people
• The entity does not have sufficient contact information

Substitute notice must include all of the following: email notification (if email addresses are available), conspicuous posting on the entity's website, and notification to major statewide media.

Encryption Safe Harbor

Washington provides an encryption safe harbor. If the personal information was secured (encrypted, redacted, or otherwise rendered unusable) at the time of the breach, notification is not required.

The definition of "secured" means encrypted in a manner that meets or exceeds the National Institute of Standards and Technology (NIST) standard, or is otherwise modified so that the personal information is rendered unreadable, unusable, or undecipherable by an unauthorized person.

If the encryption key was also compromised in the breach, the safe harbor does not apply.

Interaction with Federal Regulations

Washington addresses federal overlap in RCW 19.255.030, and the two routes it creates work differently.

Under RCW 19.255.030(1), a covered entity under HIPAA is deemed to have complied with all of chapter 19.255 with respect to protected health information if it has complied with section 13402 of the federal HITECH Act. That entity still notifies the Washington Attorney General, but it does so on the HITECH timeline, expressly notwithstanding the 30-day timeline in RCW 19.255.010(7).

Under RCW 19.255.030(2), a financial institution regulated by the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration, or the Federal Reserve System is deemed to have complied with the chapter as to "sensitive customer information" if it notifies affected consumers under the federal interagency guidelines establishing information security standards. This route carries no equivalent override of the state clock: the statute says the institution shall notify the attorney general pursuant to RCW 19.255.010, in addition to notifying its primary federal regulator.

A separate and narrower provision, RCW 19.255.010(5), covers an entity's own internal policy rather than federal law. A person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and that is otherwise consistent with the timing requirements of that section, complies by notifying affected persons in accordance with those policies. It is conditioned on the entity's own procedures matching the statutory timing, so it is not a route to a longer deadline.

Enforcement and Private Right of Action

Washington's breach notification law is enforced under RCW 19.255.040. This section splits enforcement into two distinct tracks:

Attorney General Enforcement: Under RCW 19.255.040(2), the attorney general may bring an action treating a violation as an unfair or deceptive act in trade or commerce. The statute expressly provides that an action to enforce the chapter may not be brought under RCW 19.86.090, the Consumer Protection Act's general private-action provision. The AG can seek injunctive relief, civil penalties, and restitution.

Private Right of Action: RCW 19.255.040(3)(a) gives consumers their own standalone remedy, separate from the CPA's general track: any consumer injured by a violation of the chapter may institute a civil action to recover damages. Because the statute bars routing a chapter claim through RCW 19.86.090, the treble-damages multiplier, the $25,000 cap, and the attorney's-fee provision that apply to general Consumer Protection Act claims do not automatically apply to this action. The statute's own text authorizes recovery of:

• Actual damages sustained

This private right of action still makes Washington one of the more plaintiff-friendly states for breach notification enforcement, since most states give consumers no lawsuit at all. Consumers do not need to wait for the AG to act; they can pursue claims independently.

Government Agency Requirements

State and local government agencies in Washington are governed by RCW 42.56.590, which mirrors the private-sector requirements. Government agencies must:

• Notify affected residents within 30 days of discovery
• Notify the AG when more than 500 residents are affected
• Provide the same content in their notification letters

Government agencies may also delay notification to affected consumers for up to an additional 14 days beyond the 30-day deadline, to allow the notice to be translated into the primary language of the affected consumers, under RCW 42.56.590(8).

More Washington Laws

• Washington Deepfake Laws
• Washington Employee Monitoring Laws
• Washington GPS Tracking Laws
• Washington Recording Laws