California enacted SB 354, modernizing insurance privacy rules
SB 354 was signed into law on September 27, 2026 as Chapter 481, Statutes of 2026. The law modernizes California insurance privacy requirements and is generally operative beginning July 1, 2028. It primarily concerns personal information processed in connection with insurance for personal, family, or household purposes. It is not a broad commercial cyber-insurance mandate.
- Official source
- California Legislative Information ↗
- Jurisdiction
- California
- Publication date
- September 27, 2026
- Legacy Core review
- September 30, 2026 · Christopher Green
- Source checked
- September 30, 2026
- Affected sectors
- Insurance, Financial Services, General Professional Services
- Effective date
- July 1, 2028
Summary
SB 354 was signed into law on September 27, 2026 as Chapter 481, Statutes of 2026. The law modernizes California insurance privacy requirements and is generally operative beginning July 1, 2028. It primarily concerns personal information processed in connection with insurance for personal, family, or household purposes. It is not a broad commercial cyber-insurance mandate.
Why it matters
Agencies that handle personal-lines information may need to look at privacy notices, data handling, retention, third-party relationships, safeguards, and consumer information rights before the July 1, 2028 operative date. The law does not apply to every California business or every commercial insurance transaction. A Legacy Core credential does not demonstrate compliance with SB 354.
Recommended action
Read the chaptered text on the California Legislature site. If you handle personal-lines insurance information, review with qualified counsel which provisions apply to your agency and to vendors that touch that information.