🔒 Compliance & Data Privacy

Your Daycare Had a Data Breach. California Gives You 30 Days.

Who has to be notified, what the notice is legally required to say, what changes when the breach happened at your app vendor instead of your office, and how to make the clock survivable.

By Eshan de Silva · October 11, 2026 · 8 min read

It usually starts small. A staff member's email account sends a strange message to the whole parent list. A laptop disappears from a car in the parking lot. Or your childcare management vendor emails to say they had a "security incident" and are "investigating." In every one of those cases, a clock may already be running — and in California, as of this year, it is a short one.

Most directors assume breach notification laws are for banks and hospitals. They aren't. California's statute has no employee count, no revenue floor, and no small-business exemption. If you hold parents' personal information on a computer — and you do — it applies to you.

The law that covers every center, regardless of size

The rule is California Civil Code section 1798.82. It says that a person or business that conducts business in California, and owns or licenses computerized data containing personal information, must notify any California resident whose unencrypted personal information was — or is reasonably believed to have been — acquired by an unauthorized person.

Two words do a lot of work. Unencrypted is the one that can save you: a stolen laptop with full-disk encryption turned on, and the password not taken with it, puts you in a very different position. And acquired is a lower bar than people expect — you don't have to prove a parent was defrauded. A reasonable belief that someone unauthorized got the data starts the process.

This is a separate question from the CCPA, which does have size thresholds that most childcare centers fall under. Breach notification has no such escape hatch. Small does not mean exempt.

What counts as "personal information"

The statute defines it in two ways, and childcare centers hold both.

The first is a first name or first initial plus last name, combined with any of these in unencrypted form: a Social Security number; a driver's license, California ID, tax ID, passport, or military ID number; a financial account or card number together with the code or password that would allow access to it; medical information; health insurance information; unique biometric data such as a fingerprint used for authentication; automated license plate recognition data; or genetic data.

The second is simpler and catches more centers: a username or email address together with a password or a security question and answer that would permit access to an online account.

Walk that list against what sits in your systems. Driver's license numbers on authorized-pickup forms. Immunization records and allergy plans — medical information. Tuition autopay details. Staff Social Security numbers for payroll. Parent portal logins. A single compromised office mailbox can hold every one of those as attachments, which is why email breaches are the ones that become notification events.

The 30-day clock is new

California used to require notice "in the most expedient time possible and without unreasonable delay" — vague enough that response timelines stretched for months. Senate Bill 446 changed that. Since January 1, 2026, affected California residents must be notified within 30 calendar days of the breach being discovered or reported to you. Businesses that have to notify more than 500 California residents from a single breach must also submit a sample copy of the notice to the California Attorney General, now within 15 calendar days of notifying individuals.

There are two recognized reasons to go past 30 days: a legitimate law enforcement need, and the time reasonably required to determine the breach's scope and restore the system's integrity. Neither is a blanket extension. Thirty days sounds generous until you realize most of it gets eaten by working out what was actually in the mailbox.

What the notice has to say

This is the part that surprises people: the format is prescribed. You cannot send a warm, vague email saying you take privacy seriously. The notice must be written in plain language, titled "Notice of Data Breach," set in at least 10-point type, and organized under these headings:

• What Happened?
• What Information Was Involved?
• What We Are Doing
• What You Can Do
• For More Information

At minimum it has to include your name and contact information, the types of personal information involved, the date or date range of the breach and the date of the notice, whether notification was delayed by law enforcement, and a general description of the incident. If Social Security numbers or driver's license or California ID numbers were exposed, you also have to include the toll-free numbers and addresses of the major credit reporting agencies. And if your center caused the breach, you must offer identity theft prevention and mitigation services at no cost for at least twelve months.

That last item is a real budget line. It is also the clearest argument for encrypting the devices and backups that hold family data — the cheapest version of this whole process is the one where the statute never triggers.

When the breach is at your app vendor, not your office

This is the most common scenario for childcare centers, and the most misunderstood. Your parent communication app, your billing processor, your check-in tablet platform — they hold your families' data, but they don't own it. You do.

The statute handles that directly. A business that maintains computerized personal information it does not own must notify the owner or licensee immediately after discovering a breach. Then the owner — your center — has its own 30 days from that notification to tell the families. The vendor telling you is not the vendor telling your parents. The letter still comes from you, on your letterhead, with your phone number on it.

Which makes the contract matter more than it felt like at signing. Before you renew, check three things: how fast the vendor commits to notifying you, whether they help pay for notification and credit monitoring, and whether they will name which of your families were affected rather than saying "some users." Our guide to vetting childcare app vendors covers the questions to ask.

Separately, a vendor running an online service directed to children is also subject to the federal Children's Online Privacy Protection Rule, whose amended requirements took full effect on April 22, 2026 and tightened data retention and security obligations. That is the vendor's duty rather than yours, but it gives you something concrete to ask about — see our COPPA guide for childcare apps.

Does Community Care Licensing need to know?

Directors ask this immediately, and the honest answer is: probably not as a data breach, but don't stop there.

The Title 22 reporting regulation for child care centers lists the events a licensee must report to the licensing agency — a child's death, an injury requiring medical treatment, suspected abuse, epidemic outbreaks, poisonings, catastrophic events, fires or explosions, and any unusual incident or child absence that threatens the physical or emotional health or safety of a child. Data breaches are not on that list, and a stolen tuition spreadsheet is not a licensing event.

But that catch-all deserves a careful read. If the exposed data includes home addresses in a restraining-order or contested-custody situation, this is no longer a privacy problem — it is child safety, and the timeline is the next working day by phone or fax with a written report within seven days. If there is any doubt, call your Licensing Program Analyst. That call costs nothing.

The first 48 hours

What you do immediately shapes how bad the next 30 days are.

• Contain, don't erase. Reset passwords, revoke sessions, disable the compromised account. Do not wipe and reimage the laptop — that destroys the evidence you need to work out what was taken, which is the question the whole notification turns on.
• Call your cyber insurer first. Most policies require prompt notice and many provide a breach coach, forensics, and the notification mailing itself. Calling them late can cost you coverage. If you don't have a policy, our cyber insurance guide covers what underwriters now expect.
• Write down what you know and when you learned it. Dates, times, who said what. The 30 days are measured from discovery, so your own record of when the clock started is the document you will lean on hardest.
• Find out what was in there. Not "the email account was accessed," but which messages and attachments, and which families appear in them. This is the step that takes the longest and the step nobody budgets for.
• Say nothing specific until you know. A premature all-clear that you later retract does more damage to parent trust than a careful notice sent on day 25.

How to make 30 days survivable

The centers that handle this well aren't the ones with the best incident response binder. They are the ones that did boring work in advance.

• Know where family data lives. List every system holding parent or staff personal information, including the shared drive folder somebody made in 2021. You cannot scope a breach in two weeks if the inventory takes two weeks by itself.
• Encrypt everything portable. Full-disk encryption on every laptop and tablet, encrypted backups, device management that lets you wipe a lost device remotely. This is the single control that can keep an incident from becoming a notification.
• Turn on multi-factor authentication and keep audit logs. MFA stops most account takeovers outright. Logging determines whether you can say what was accessed — and whether your answer is "these eleven families" or "we have to assume everyone."
• Hold less. The driver's license scan from a 2019 enrollment is pure liability now. A retention schedule that actually deletes things shrinks every future breach. Collecting visitor and pickup data through a system like SenLobby.ai, rather than a clipboard copied into a spreadsheet, keeps it in one governed place instead of four.
• Have the notification letter drafted already. Fill in the blanks under stress; don't invent the structure under stress. The five headings above are a template waiting to be used.

None of this is dramatic, and that is the point. If you want the longer version of the response playbook, our incident response guide covers it step by step, and our childcare data privacy guide covers the day-to-day handling rules that keep you out of this situation. If you would rather someone else owned the encryption, the logging and the vendor questions, that is exactly the quiet background work EDCON's managed IT and compliance support does for childcare centers across Los Angeles, Oxnard, Ventura, and Azusa.

Common questions from childcare directors