CA SB446

Requires businesses to notify California residents of data breaches within 30 calendar days of discovery, replacing the previous "most expedient time possible" standard

Allows delay of breach notification to accommodate law enforcement investigations or to determine the scope of the breach and restore data system integrity

Mandates submission of a sample breach notification to the Attorney General within 15 calendar days of notifying consumers when a breach affects more than 500 California residents

Applies to breaches involving unencrypted personal information or encrypted data where the encryption key was also compromised