The law also requires that a sample copy of a breach notice sent to more than 500 California residents must be provided to the California Attorney General. 1798.29(a) for state agencies and California Civ. (You can read the law here: California Civil Code s. California law requires a business or state or local agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person.
