After a Data Breach: A California Vendor's Notification Duties and Customer Contract Exposure

Last updated: October 2026

A California business that discovers a breach of unencrypted personal information, or of encrypted data where the key was also taken, has two sets of obligations. The first is statutory: notice to the affected residents, generally within 30 calendar days of discovery, and an immediate duty to notify any data owner whose information the business was holding for it. (Civ. Code, § 1798.82.) The second is contractual: the service agreement, the security representations, and the data processing terms with each customer. Kolmogorov Law, P.C. advises vendors and their customers on the legal side of a breach in Orange County, Los Angeles, and across California, and litigates the disputes that follow.

Call (909) 235-6116 or contact us online if your company has had a security incident and customers are asking questions.

The vendor's position

A software vendor to broker-dealers, a payroll processor, a marketing agency with client customer lists, a logistics company with shipper data. When one of them is breached, the personal information at risk usually belongs to its customers' customers. The vendor owes notice to the data owners, the data owners owe notice to the individuals, and the customer contract decides who pays for all of it. Add a ransom demand, a cyber insurer with its own counsel, and a largest customer threatening to terminate, and the first week is chaos. The legal sequence below is what I walk clients through.

Statutory notice: who, when, and to whom

The duty falls on any person or business that conducts business in California and owns or licenses computerized data containing personal information. It must disclose a breach to each California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code, § 1798.82, subd. (a).) The same duty applies to encrypted information where the key or credential was also taken and could make the data readable. (Civ. Code, § 1798.82, subd. (a).)

Timing changed recently. The disclosure must be made within 30 calendar days of discovery or notification of the breach. Delay is permitted for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. (Civ. Code, § 1798.82, subd. (a)(2).) Earlier versions of the statute used a looser "most expedient time possible" standard; the current text sets the 30-day clock.

For a vendor, the key provision is the maintainer's duty. A person or business that maintains computerized data containing personal information it does not own must notify the owner or licensee immediately following discovery of a breach. The trigger is that the information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code, § 1798.82, subd. (b).) Immediately means immediately. The vendor does not get to finish its investigation first.

If a single breach requires notice to more than 500 California residents, the business must electronically submit a single sample copy of the notification to the Attorney General. The copy excludes personally identifiable information and is due within 15 calendar days of notifying affected consumers. (Civ. Code, § 1798.82, subd. (f).)

Other states' laws apply to their residents, and sector rules may add more. The notice plan is built jurisdiction by jurisdiction.

The private right of action

California's consumer privacy law gives consumers a direct claim. It applies when nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure because the business failed to implement and maintain reasonable security procedures appropriate to the information. An email address together with a password or security question that would permit access to the account is covered as well. (Civ. Code, § 1798.150, subd. (a)(1).) The remedy is statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater. (Civ. Code, § 1798.150, subd. (a)(1)(A).) The statute requires inflation adjustment of those figures every other year, and the California Privacy Protection Agency set them at $107 to $799 effective January 1, 2025.

Before suing for statutory damages, the consumer must give the business 30 days' written notice identifying the provisions violated; no notice is required for a suit solely for actual pecuniary damages. (Civ. Code, § 1798.150, subd. (b).) If a cure is possible and the business cures and so certifies in writing, no statutory damages action may be brought. The statute adds that implementing reasonable security after the breach is not a cure for that breach. (Civ. Code, § 1798.150, subd. (b).) That is the class action exposure in a large consumer breach, and the reason the 30-day notice letter has to be answered carefully.

The customer contract

For a business-to-business vendor, the larger exposure is usually contractual. The master services agreement contains security representations and a data processing addendum. It often has breach notification timelines shorter than the statute's, indemnity provisions, and a limitation of liability with a carve-out for data breaches. A customer's demand after a breach typically asserts three things. The vendor's security did not match what it represented. Notice was late under the contract. And the customer's remediation costs and regulatory exposure are the vendor's problem under the indemnity.

The answer lives in the same contract. What exactly was represented. Whether the limitation of liability caps the claim. Whether the customer's own conduct, such as weak credentials, contributed. We read the contract before the first substantive response to a customer goes out, because that response will be an exhibit. Our pages on breach of contract and responding to a demand letter cover the litigation side, and our article on AI vendor contracts addresses the clauses to negotiate before a problem arises.

Insurance, forensics, and privilege

Cyber insurance policies require prompt notice and often control the choice of forensic and breach counsel. Late notice is a coverage problem. Forensic work should be engaged through counsel so that the investigation's findings are privileged where the law allows; a forensic report commissioned directly by the company is a discoverable roadmap for the customer's lawsuit. These are first-week decisions.

What we do

We sequence the obligations: insurer notice, immediate notice to data owners, the 30-day resident notice plan, the Attorney General sample, and the customer communications, each reviewed against the contract and the statute. Then we handle the disputes that follow: the customer indemnity demand, the consumer notice letter under the privacy statute, and any suit. Our California AI and privacy compliance guide and our CIPA guide cover the adjacent rules.

Where these cases are heard

Customer contract disputes are heard in the forum the contract names, often arbitration or the courts of another state. Consumer privacy claims are typically filed in the Superior Court: the Central Justice Center in Santa Ana for Orange County, the Stanley Mosk Courthouse for Los Angeles. They land in federal court when a class is pleaded and the parties are diverse.

What to bring to the first meeting

Bring the incident timeline, the forensic findings if any, the customer contracts and data processing terms, the cyber policy, the list of data categories and affected individuals by state, and every communication sent to customers or affected persons so far. If a ransom demand was made, bring it and do not respond to it without advice.

Frequently asked questions

How long does a California business have to notify customers of a data breach?

Within 30 calendar days of discovery or notification of the breach, subject to delay for law enforcement needs or to determine the breach's scope and restore the reasonable integrity of the data system. (Civ. Code, § 1798.82, subd. (a)(2).)

What are a vendor's obligations when it holds data for another company?

A business that maintains personal information it does not own must notify the owner or licensee of the breach immediately following discovery. (Civ. Code, § 1798.82, subd. (b).) The owner then handles notice to individuals, though the contract may shift the work and the cost.

Do we have to notify the California Attorney General?

If a single breach requires notice to more than 500 California residents, a single sample copy of the consumer notice, excluding personally identifiable information, must be submitted electronically to the Attorney General within 15 calendar days of notifying consumers. (Civ. Code, § 1798.82, subd. (f).)

Can consumers sue a business after a data breach?

Yes, for breaches of nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security. Statutory damages run $100 to $750 per consumer per incident, adjusted for inflation to $107 to $799 as of January 1, 2025, after a 30-day notice and cure period. (Civ. Code, § 1798.150.)

Is a data breach a breach of contract with our customers?

Often it is alleged as one, based on security representations and notice timelines in the service agreement. Whether the claim succeeds, and how much the limitation of liability caps it, depends on the contract's exact terms.

Talk to a California business litigation attorney

If your company has had a breach and customers, consumers, or regulators are now involved, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California.

This page provides general information about California law and is not legal advice. Breach obligations depend on the data involved, the states of the affected individuals, the contracts, and the facts.