Your Business Received a 30-Day Notice Under Civil Code Section 1798.150 After a Data Breach

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

The letter is the written notice a consumer must send before suing for statutory damages under the California Consumer Privacy Act. Civil Code section 1798.150 gives the business 30 days. If a cure is possible, and the business actually cures the violation and says so in an express written statement within that time, no action for statutory damages may be started. The statute sets those damages at $100 to $750 per consumer per incident, adjusted for inflation. Kolmogorov Law, P.C. defends California businesses that receive these notices.

Call (909) 235-6116 or contact us online to discuss a notice or complaint that followed a data breach.

What the 30 days mean

Before starting an action for statutory damages, for one person or for a class, a consumer must give the business 30 days' written notice. The notice must identify the specific provisions of the Act the consumer says were violated. (Civ. Code, § 1798.150, subd. (b).)

No court set this deadline, and nothing is filed when it passes. What ends is the period in which a cure can bar statutory damages. An individual suing solely for actual pecuniary damages needs no notice.

Notice to affected residents and, in larger breaches, to the Attorney General is a separate duty, covered on our page about data breach duties for vendors.

Whether your company is a covered business

The claim runs against a "business" as the Act defines it. That is a for-profit entity doing business in California that collects consumers' personal information, determines the purposes and means of processing it, and meets at least one of three thresholds. (Civ. Code, § 1798.140, subd. (d)(1).)

Annual gross revenues above $25,000,000 in the preceding calendar year, as adjusted for inflation. The agency's posted figure effective January 1, 2025 is $26,625,000.
Buying, selling, or sharing the personal information of 100,000 or more consumers or households a year.
Deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information.

The definition also reaches certain commonly branded affiliates and joint ventures of such businesses. A consumer is a natural person who is a California resident. (Civ. Code, § 1798.140, subds. (d)(2), (d)(3), (i).) A company outside the definition should say so in its response.

What information counts

The breach claim reaches less data than the rest of the Act. It covers nonencrypted and nonredacted personal information as defined in the data security statute. That means a first name or initial and last name, combined with one of the following. (Civ. Code, § 1798.81.5, subd. (d)(1)(A).)

A social security number.
A driver's license, tax identification, passport, or other unique number from a government identity document.
An account or card number with any code or password needed to reach the account.
Medical or health insurance information.
Unique biometric data or genetic data.

An email address combined with a password, or a security question and answer, that would permit access to the account is also covered. (Civ. Code, § 1798.150, subd. (a)(1).) A breach limited to names, email addresses, or order history is outside that list.

What the consumer has to prove

The information must have been subject to unauthorized access and exfiltration, theft, or disclosure. That must have happened as a result of the business's violation of its duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. (Civ. Code, § 1798.150, subd. (a)(1).)

An intrusion is not, by that fact alone, the violation, because the statute ties liability to a security failure and to causation. And the sections cited here do not define reasonable security. The question is decided on evidence: which controls existed, whether they were followed, and what the intruder exploited.

What a cure can and cannot be

The statute applies its cure rule only where a cure is possible. Suppose the business actually cures the noticed violation within the 30 days. Suppose it also gives the consumer an express written statement that the violations have been cured and that no further violations shall occur. Then no action for individual or class-wide statutory damages may be initiated. (Civ. Code, § 1798.150, subd. (b).)

Implementing and maintaining reasonable security after a breach does not constitute a cure with respect to that breach. The text does not say what does.

If the business keeps violating the Act in breach of the written statement, the consumer may sue to enforce it and pursue statutory damages for each breach. (Civ. Code, § 1798.150, subd. (b).) The statement should not be signed without a basis for the promise it makes.

What is at stake

A consumer may recover damages of not less than $100 and not more than $750 per consumer per incident, or actual damages, whichever is greater. Injunctive and declaratory relief are also available. (Civ. Code, § 1798.150, subd. (a)(1).) The California Privacy Protection Agency adjusts the dollar figures for inflation on January 1 of each odd-numbered year and posts them on its website. (Civ. Code, § 1798.199.95, subd. (d).) The range the agency posted effective January 1, 2025 is $107 to $799. The next adjustment is due on January 1, 2027.

In setting statutory damages, the court considers relevant circumstances the parties present. The statute's examples include the nature and seriousness of the misconduct, the number of violations, how long it lasted, willfulness, and the defendant's assets, liabilities, and net worth. (Civ. Code, § 1798.150, subd. (a)(2).)

The private claim is limited to these breach violations and cannot rest on other sections of the Act. (Civ. Code, § 1798.150, subd. (c).) Contract terms that purport to waive or limit rights under the Act, including a representative action waiver, are declared void. (Civ. Code, § 1798.192.) How that rule applies to an arbitration clause governed by federal law is not answered by the statute. Our page on a business named in a class action explains how class exposure is managed.

What to do within the 30 days

Record the date the notice arrived.
Preserve the logs and forensic images. Our litigation hold page explains the duty.
Give notice to your cyber and liability insurers. See whether business insurance covers a lawsuit and our page on denied cyber insurance claims.
Decide with counsel whether a cure can be claimed and what the written response will say.

Do not send an informal apology that describes the security gaps.

What to bring to the first meeting

The notice letter or complaint, with the date received.
The incident timeline and any forensic report.
A list of the data elements involved and the number of California residents affected.
Your prior-year gross revenue and consumer record counts.
Cyber and general liability policies.

Frequently asked questions

After a breach we got a letter giving us 30 days to cure before a class action. What does that mean?

It is the pre-suit notice required by California Civil Code section 1798.150. A consumer who wants statutory damages, alone or for a class, must first give the business 30 days' written notice of the provisions violated. If a cure is possible and the business cures and states so in writing within the 30 days, an action for statutory damages may not be started. An individual claim solely for actual pecuniary damages requires no notice.

How much are statutory damages for a data breach under the CCPA?

The California statute provides damages of not less than $100 and not more than $750 per consumer per incident, or actual damages if greater. The state privacy agency adjusts those figures for inflation every odd-numbered year, and the range it posted effective January 1, 2025 is $107 to $799. A court choosing the amount weighs factors such as the seriousness and duration of the misconduct, willfulness, and the defendant's assets, liabilities, and net worth.

Does the CCPA apply to a small business?

Only if the company meets the Act's definition of a business. A for-profit company doing business in California is covered if it had annual gross revenues above $25,000,000, as adjusted for inflation. It is also covered if it buys, sells, or shares the personal information of 100,000 or more consumers or households a year, or earns at least half its revenue from selling or sharing it. Certain commonly branded affiliates of covered businesses are included too.

Our company fixed its security right after the breach. Does that count as a cure under Civil Code 1798.150?

Not for that breach. California Civil Code section 1798.150 states that implementing and maintaining reasonable security procedures after a breach does not constitute a cure with respect to that breach. The statute does not define what a cure of a completed breach would be, so the point is argued case by case.

Can a consumer sue under the CCPA for other privacy violations?

Not under this section. California Civil Code section 1798.150, subdivision (c), says the private cause of action applies only to the data breach violations defined in subdivision (a). It may not be based on violations of any other section of the Act. Nor may the Act serve as the basis for a private action under another law, though duties under other laws remain.

Talk to a California business litigation attorney

If your business has received a notice under section 1798.150 or been sued after a breach, call (909) 235-6116 or contact us online before the 30 days run. Kolmogorov Law, P.C. is located in Irvine, California.

This page provides general information about California law and is not legal advice. Outcomes depend on the breach, the facts, and the court.