AI data exposure and the California data breach notification law: is it a breach?

What does an AI data breach look like at a firm?

An operations associate at a Los Angeles RIA needs to reformat a client list before a custodian transition. To save time, she pastes a spreadsheet into a free AI chatbot on her personal account. The sheet holds 600 client names, account numbers, and for some clients, Social Security numbers. A prompt monitoring alert flags it the next morning. The CCO now has to decide whether this is a breach that triggers notice, and the California clock may already be running.

The same facts could arise at an accounting firm with taxpayer data, a law firm with client files, or a nonprofit with donor records. The questions below apply to any business that owns or licenses computerized personal information about California residents, which is who the California data breach notification law covers.

What counts as a breach under the California data breach notification law?

Civil Code section 1798.82 defines a breach as the unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information. Notice is owed to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Two parts of that definition carry the analysis in an AI case. First, "acquisition": the data has to have reached someone. Second, "unauthorized": the recipient has to lack authority to have it. The statute excludes good faith acquisition by an employee or agent of the business for its purposes, as long as the information is not further used or subject to further unauthorized disclosure. The employee who pasted the data was authorized to hold it. The open question is the AI provider.

Is an AI provider an unauthorized recipient?

It depends on the terms the data went in under, and that is a fact question for the firm and its counsel. The statute does not mention AI. The facts that usually decide it are knowable, and they should be gathered first.

• Account type. A personal consumer account runs under the provider's consumer terms. An enterprise tenant the firm contracted for runs under the firm's agreement.
• Training and retention. Whether the provider's terms in effect on that date allowed it to keep inputs or use them to train models.
• Agency. Whether the provider was acting as the firm's service provider or agent under a written contract, which bears on the good faith exception.
• Access. Whether anyone other than the employee could see the conversation, such as a shared link or a public workspace.
• Deletion. Whether the conversation was deleted, and whether the provider confirms deletion from its systems.

An enterprise tool the firm approved, under a contract barring training and limiting retention, presents very different facts from a consumer account whose terms permit the provider to retain and use inputs. The firm should document which side of that line it is on and why.

Which data elements trigger California notice?

Specific listed elements, usually combined with a name. Under section 1798.82(h), personal information means a first name or initial and last name combined with an unencrypted Social Security number, driver's license or other government ID number, a financial account or card number with any required code or password, medical or health insurance information, biometric data, automated license plate recognition data, or genetic data. A username or email address with a password or security answer also counts on its own, without a name.

In the scenario, names with Social Security numbers qualify. Names with account numbers but no access code or password may fall outside that element, a point counsel should confirm, and they can still matter under other rules. Encryption does not help here, because the employee pasted readable text.

How soon after a breach must notice go out in California?

Within 30 calendar days of discovery, under the SB 446 amendment effective January 1, 2026, with delay permitted for law enforcement needs or to determine the scope of the breach and restore system integrity. If more than 500 California residents are notified, a sample notice goes to the Attorney General within 15 calendar days of notifying residents.

Financial firms carry a second clock. An SEC-registered adviser or broker-dealer must notify affected individuals under Regulation S-P, 17 CFR 248.30(a)(4) as soon as practicable, and no later than 30 days after becoming aware of unauthorized access to or use of sensitive customer information, unless a reasonable investigation finds no reasonable likelihood of substantial harm or inconvenience (see how to document a no-notice decision). Reg S-P's definition of sensitive customer information is broader than California's list, so an account number may matter there even when it does not under section 1798.82. Firms under the FTC Safeguards Rule must notify the FTC within 30 days of discovering unauthorized acquisition of unencrypted information of at least 500 consumers (see how to report a breach to the FTC).

What is the litigation exposure?

Civil Code section 1798.150 gives California consumers a private right of action when nonencrypted, nonredacted personal information is subject to unauthorized access and exfiltration, theft or disclosure because the business failed to maintain reasonable security. Statutory damages run from $107 to $799 per consumer per incident, as adjusted effective January 1, 2025. The CCPA's GLBA exemption does not apply to this section, so financial firms are inside it. California's general reasonable security duty sits in section 1798.81.5, which requires reasonable security procedures appropriate to the information. That section exempts financial institutions subject to the California Financial Information Privacy Act and businesses regulated by a law that gives greater protection, so counsel should confirm which security standard applies to your firm.

That is why the record of what the firm had in place before the paste matters as much as the response afterward: the AI policy, the approved tool list, the controls that should have stopped the upload, and the alert that caught it.

What should the firm do in the first 72 hours?

1. Preserve the evidence: the alert, the prompt and file content if captured, the account used, timestamps and the device.
2. Ask the employee to stop, not delete anything yet, and describe exactly what was pasted and where.
3. Identify the provider's terms in effect on the date and the account type.
4. Request deletion from the provider in writing and keep the response.
5. Count the affected individuals by state of residence and data element.
6. Bring in counsel to make the breach determination under section 1798.82 and any other rule that applies, such as Reg S-P or the Safeguards Rule.
7. Calendar every deadline from the date of discovery, including the 15-day Attorney General window.

What should the firm do this quarter?

• Decide which AI tools are approved, under which contracts, and publish the list. Advisers can start with how to use ChatGPT without leaking client data.
• Block unapproved AI sites on firm devices and require the work account for approved ones.
• Turn on prompt monitoring or capture for approved tools so the firm can reconstruct what was shared.
• Add an AI exposure scenario to the incident response plan, including who decides whether a provider counts as an authorized recipient. SEC-registered firms can fold it into the annual review of the Reg S-P incident response program.
• Run a tabletop on this exact scenario and record the decisions.

How can s90 help with an AI data exposure?

s90 monitors AI use across client environments, alerts when regulated data reaches an unapproved tool, and supports the investigation that follows. Our agreements commit s90 to notify you of a breach within 72 hours and to produce evidence within 24 hours of a request, so your counsel has facts to work from early in the 30-day window. If you want to test your plan against this scenario, we are glad to walk through it with you.