Washington law requires businesses, individuals, and public agencies to notify any Washington resident who is at risk of harm because of the unauthorized acquisition of data that compromises the security, confidentiality, or integrity of that resident’s personal information.
Under a law enacted in 2015, any business, individual, or public agency that is required to issue a security breach notification to more than 500 Washington residents as a result of a single security breach shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General.
During the 2019 Legislative Session the Attorney General proposed request-legislation to strengthen Washington’s Data Breach Notification laws. HB 1071 passed unanimously out of both chambers of the Legislature, and was signed into law on May 7, 2019, to go into effect on March 1, 2020. For more information on these updates, see the HB 1071 FAQ page.
Please see the “Reporting Data Breaches” section of our business resources page for more information on how to submit a data security breach notification sample to our office.
If you are a consumer who received a data breach notice, or you believe your personal information was lost or exposed, and you want to know what steps you should take to protect yourself, visit IdentityTheft.gov.
Data security breach notices submitted to our office in accordance with the law that took effect July 24, 2015, are published for public education purposes, below. To read a notice, click on the name of the organization in the list.
Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Passport Number; Medical Information; Other
Name; Social Security Number; Driver's License or Washington ID Card Number; Financial & Banking Information; Username and Password/Security Question Answers; Other
Other Languages