Short answer: The DC data breach notification law (D.C. Code § 28-3851 et seq.) says that if you do business in the District and a breach exposes a DC resident’s personal information, you have to tell that person “in the most expedient time possible and without unreasonable delay.” If 50 or more DC residents are affected, you also have to notify the DC Attorney General in writing, no later than the residents. If Social Security or taxpayer ID numbers were involved, you owe affected residents at least 18 months of free identity theft protection.
The details are where small offices get caught out, especially law firms, associations, nonprofits and medical practices that hold a lot of client and member data.
Who the DC data breach notification law covers
The law applies to any “person or entity” that conducts business in the District of Columbia and owns or licenses electronic data that includes personal information. The definitions in § 28-3851 are broad: individuals, firms, corporations, partnerships, cooperatives, associations, trusts and “any other organization.” Only the DC government is left out.
So a 12-person law firm downtown is covered. If that is your firm, see our guide to law firm cybersecurity in DC. So is a trade association with a member database, a nonprofit with donor records, and a dental practice with patient files.
One more wrinkle: notice goes to DC residents. A firm based in Fairfax or Bethesda with clients or staff living in the District can owe DC notices too, on top of Virginia’s or Maryland’s own rules. Our incident response plan template covers the Virginia side.
What counts as personal information in DC
DC’s definition got much wider with the 2020 Security Breach Protection Amendment Act. Personal information now means a person’s name (or another personal identifier) combined with any of these:
- Social Security, taxpayer ID, passport, driver’s license, DC ID or military ID number
- A card or account number, or any code or password that opens a financial account
- Medical information, including dental and mental health treatment
- Genetic information, health insurance information or biometric data such as a fingerprint
It also covers a username or email address plus a password or security question that opens an email account. So a single phished Microsoft 365 password can count as a breach.
What counts as a breach, and what doesn’t
A breach is the unauthorized acquisition of electronic data, or a device storing it, that compromises the security, confidentiality or integrity of personal information. The DC Attorney General’s guidance gives examples: hacking and ransomware, but also plain employee error, like emailing a file to the wrong person.
The law lists three exceptions:
- Good-faith access by an employee for business purposes, as long as the information isn’t misused or disclosed further.
- Encrypted or redacted data that’s unusable to the person who took it. This exception falls away if the encryption key or password was also exposed.
- No likely harm. You can decide notice isn’t needed if, after a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement, you reasonably determine the breach likely won’t harm anyone.
That third point surprises people: in DC you can’t decide on your own that a breach was harmless. The encryption exception is the one you can plan for. A stolen laptop with BitLocker turned on is a very different week from one without it.
Who you have to notify, and when
DC residents
Notify every affected DC resident “in the most expedient time possible and without unreasonable delay.” You get time to work out the scope and secure your systems, and law enforcement can ask you to delay. There’s no fixed number of days, which isn’t the same as room to wait.
Notice can be in writing, or by email if the person agreed to electronic notices. If notice would cost over $50,000, reach over 100,000 people, or you lack contact details, substitute notice (email, a website notice and local media) is allowed.
The DC Attorney General (50 or more residents)
Under § 28-3852, if the breach affects 50 or more DC residents, you must send written notice to the Office of the Attorney General, and no later than when you notify residents. You can’t hold it back while you’re still counting.
The AG’s office takes these reports at databreach@dc.gov. The notice covers who you are, what happened, the types of data, how many DC residents were affected, the cause if known, what you’ve done to fix it and help residents, the dates, your headquarters if it’s outside DC, any known foreign involvement, and a sample of your resident notice.
Credit bureaus and vendors
If you notify more than 1,000 people, also tell the nationwide credit bureaus about the timing, distribution and content of the notices (not the names). And if you hold data for someone else, like a payroll processor, bookkeeper or IT provider, you must tell the data owner “in the most expedient time possible following discovery.”
What the notice to residents must say
DC spells out what goes in each letter, so another state’s template won’t do. Each notice needs:
- The categories of information that were, or are believed to have been, taken
- Your business address and phone number (and toll-free number if you have one)
- Contact details for the major credit bureaus, and a statement that a security freeze is free, with how to request one
- Contact details for the FTC and the DC Attorney General’s office, which both offer identity theft guidance
If only email logins were involved, an electronic notice telling people to change their password and secure other accounts with the same login is enough.
Free identity theft protection for SSN breaches
If Social Security or taxpayer ID numbers were exposed, you must offer each affected DC resident free identity theft protection for at least 18 months, with everything they need to enroll. If you keep HR files, tax forms or intake records with SSNs, plan for that cost now.
The “reasonable security” rule most offices miss
The 2020 update also added a duty that applies before anything goes wrong. Anyone who owns, licenses, maintains or handles personal information of DC residents must “implement and maintain reasonable security safeguards” that fit the data and the size of the organization.
Two parts are easy to overlook:
- Vendor contracts. If you share personal information with a service provider under a written agreement, it must require the vendor to keep reasonable security in place.
- Disposal. When you get rid of records, including old computers, drives and copiers, you must take reasonable steps to protect the personal information on them.
The statute doesn’t define “reasonable.” In our experience the basics carry most of the weight: MFA on every Microsoft 365 account, encrypted laptops, tested backups, admin rights for only the few who need them, and drives wiped before old equipment leaves the building. When we audit a new client’s Microsoft 365, old email forwarding rules and accounts without MFA are among the first things we look for. Our Microsoft 365 security checklist walks through the email side step by step.
A violation of the breach law is treated as an unfair or deceptive trade practice under DC’s consumer protection law, which the Attorney General can enforce.
Medical, dental and other HIPAA-covered practices
If your practice follows the HIPAA breach notification rules (or the Gramm-Leach-Bliley Act rules for financial firms) and sends compliant notices, DC treats you as meeting its resident notice rule. You still have to notify the DC Attorney General when 50 or more DC residents are affected. Compliance with HIPAA or GLBA security rules also counts as meeting DC’s safeguards duty.
A first-week breach checklist for DC organizations
This isn’t legal advice. Bring in your attorney and cyber insurance carrier on day one.
- Contain it. Reset compromised passwords, disconnect affected machines without powering them off, and keep logs.
- Find out what data was involved and whether it was encrypted.
- Count affected people by state. DC, Virginia and Maryland each have their own rules.
- At 50 or more DC residents, send the AG notice to databreach@dc.gov no later than the resident letters.
- Fix the cause and write down what you changed. The AG notice asks for it.
How Xala Tech Services can help
Xala Tech Services is a managed IT provider based in Fairfax, Virginia, serving Washington DC and the DMV since 2020. Our governance and compliance services help you put the safeguards DC expects in place, document them, and tighten vendor and disposal practices. We also offer CMMC support.
We serve law firms, associations, nonprofits and medical and dental offices across the District from our Fairfax office (see our managed IT services in Washington DC page). Our response time is 30 minutes, and after-hours support is available.
Want to know where you stand before something happens? Book a free Microsoft 365 security scan (normally $1,500). Call (703) 340-1110 (Mon–Fri, 8:30 AM–6:00 PM) or contact us.
Frequently asked questions
Who has to follow the DC data breach notification law?
Any person or entity that conducts business in the District of Columbia and owns or licenses electronic personal information, including companies, law firms, associations and nonprofits. Notice is owed to affected DC residents, so a business based in Virginia or Maryland can still owe DC notices.
When do you have to notify the DC Attorney General about a breach?
If a breach affects 50 or more DC residents, you must send written notice to the Office of the Attorney General for the District of Columbia without unreasonable delay, and no later than when you notify residents. The AG’s office takes these reports at databreach@dc.gov.
Is a hacked email account a reportable breach in DC?
It can be. DC’s definition of personal information includes a username or email address combined with a password or security question that allows access to an email account. If only those login details were exposed, an electronic notice telling people to change their password is allowed.
Do we have to notify people if the stolen data was encrypted?
Usually not. Encrypted or redacted data that’s unusable to an unauthorized person is excluded from the definition of a breach. That exception may not apply if the key or password protecting the data was also exposed.
Do HIPAA-covered medical and dental practices still have to notify the DC Attorney General?
Yes. A practice that follows the HIPAA breach notification rules and sends compliant notices is treated as meeting DC’s resident notice requirement, but it must still send written notice to the DC Attorney General when 50 or more DC residents are affected.