Data Breach Notification Statutes – Washington

Last Updated: 02/28/2024

• Applicable Statute: Wash. Rev. Code §§ 19.255.005–.040C
• Attorney General Notice Required: Yes, if more than 500 residents are notified, the subject entity must also notify the Attorney General.
• Timing : Within 30 days after discovery.
• Method: Online form at https://fortress.wa.gov/atg/formhandler/ago/databreachnotificationform.aspx
• Content : Such notice must include the number of Washington consumers affected, or an estimate if the exact number is not known; a list of the types of personal information that were or are reasonably believed to have been impacted; the time frame of exposure, if known, including the date of the breach and the date of the discovery; and a summary of steps taken to contain the breach. The entity must submit a single sample copy of the security breach notification, excluding any personally identifiable information. The notice to the Attorney General must be updated if any of the information s unknown at the time notice is due.
• Consumer Notice Requirements:
• Timing: Must be made in the most expedient time possible and without unreasonable delay, but no more than 30 calendar days after the breach was discovered, consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system. Notice required no more than 30 days after breach is discovered.
• Content: Must be written in plain language and must include, at a minimum, the following: 
• The subject entity’s name and contact information;
• A timeframe of exposure, including the date of the breach and date of discovery, if known;
• A list of the types of personal information that were, or are reasonably believed to have been, the subject of breach; and
• The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed personal information
• Method: Written notice, or electronic notice if consistent with E-SIGN. Substitute notice is available under certain conditions.
• If a breach involved a username and password, notice can be sent electronically or by e-mail. The notice must meet the content requirements of the statute and inform the recipient to promptly change their password and take other steps to protect their information. If the breach involves login credentials of an e-mail account furnished by the subject entity, the entity cannot provide notice by e-mail to that account.