Insurance Agencies (California)

Licensed California insurance agents and brokers

Binding framework

California breach notification (Cal. Civ. Code § 1798.29 / § 1798.82); CCPA/CPRA if revenue and data thresholds are met; CDI licensing rules

California insurance agents face state breach-notification and privacy obligations, but California has not adopted the NAIC Insurance Data Security Model Law (#668) that applies in roughly 28 other states.

Key obligations (summary)

California data breach notification when personal information is compromised
CCPA privacy and security obligations when statutory thresholds apply
CDI email and license disclosure requirements for licensed agents

How Legacy Core fits

Legacy Core helps agents document cybersecurity readiness, strengthen security practices, and provide verifiable evidence of their commitment through an independent trust credential and public registry. Legacy Core credentials support cybersecurity readiness and documentation. They are not legal opinions or certifications of regulatory compliance, and they do not demonstrate compliance with SB 354.

Signed law

A signature is not the same as a duty that applies today. Check the operative date and who the law covers.

SB 354: Enacted. Signed September 27, 2026. Chapter 481, Statutes of 2026. Generally operative July 1, 2028.
SB 354 was signed into law on September 27, 2026. The law modernizes California insurance privacy requirements and is generally operative beginning July 1, 2028. It primarily concerns personal information processed in connection with insurance for personal, family, or household purposes. Readiness topics include privacy notices, data handling, retention, third-party relationships, safeguards, and consumer information rights. It is not a broad commercial cyber-insurance mandate.

Do not claim

· NAIC Model Law #668 is current law in California
· Legacy Core satisfies NAIC ISP requirements
· Legacy Core provides SB 354 compliance
· A Legacy Core credential demonstrates compliance with SB 354
· All California businesses or commercial insurance transactions are directly subject to SB 354

Primary sources

Confidence: HIGH. Last reviewed 2026-09-30.

Ready for the credentialing pathway?

See the short conversion page for insurance agencies (california), or start the free Trust Audit.

View Insurance Agencies (California) pathway Free Trust Audit

What a Legacy Core credential does not attest to

A Trust Badge documents demonstrated readiness against a dated Standards Release (assessment basis: NIST CSF 2.0 and CIS Controls v8). It is not a substitute for industry-specific legal or regulatory obligations.

FTC Safeguards Rule or WISP compliance (CPAs / tax preparers)

HIPAA compliance or OCR audit readiness (medical / dental)

ABA or State Bar ethics sign-off (attorneys)

SEC Regulation S-P compliance (investment advisers)

NAIC Insurance Data Security Model Law (including in California, not adopted)

CCPA cybersecurity audits (threshold-gated regulation)

Cyber insurance approval or claim guarantee

Penetration test, SOC 2, CMMC, or government endorsement

Legacy Core is aligned with NIST CSF 2.0 and CIS Controls v8. Legacy Core is not affiliated with, endorsed by, or accredited by NIST, CIS, or any government agency. Tracking a framework does not constitute a determination of legal or regulatory compliance. Legacy Core supports cybersecurity readiness and trust-building and does not provide legal advice. Businesses should consult qualified legal or compliance professionals regarding requirements specific to their industry and operations.

Industry-specific obligations by vertical: Regulatory context guides