Skip to content
770-587-4595

Cyber Liability by state

Washington data breach notification law and cyber insurance

Direct answer

What is Washington's data breach notification law?

Washington's breach notification law (Wash. Rev. Code sect. 19.255.010) requires businesses to notify affected residents in the most expedient time possible and without unreasonable delay, but not later than 30 days after discovery of the breach after a breach of personal information.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Washington requires businesses to notify affected residents within 30 days of discovering a breach, with Attorney General notice when 500 or more residents are affected. Cyber liability insurance typically covers the forensics, notification, and legal review this short deadline demands.

Consumer notification deadline
In the most expedient time possible and without unreasonable delay, but not later than 30 days after discovery of the breach
Regulator notice
Notify the Washington Attorney General within 30 days when a breach affects 500 or more Washington residents.
Safe harbor
Notification is not required if the compromised data was encrypted, secured, or made unusable and the key was not acquired.
Enforcement
Violations are enforceable by the Attorney General under the state's consumer protection act, and affected residents may bring a civil action.

Statutes and sources

  • Washington Data Breach Notification Law

    Wash. Rev. Code sect. 19.255.010

Regulator: Washington Attorney General . Last verified 2026-07-29 from the official source .

Related Washington compliance pages

Insurance

Washington workers' compensation

Licensing and bonds

Washington licensing, bond, and regulator directory

Cyber Liability in other states

Back to the cyber liability coverage guide

Get Washington coverage handled

Share a few details and an agent will respond within one business day.

Request a quote Talk to an agent