On April 23, 2015, Washington State enacted H.B. 1078, which amends Washington’s data breach notification statute. Among other changes, the new law expands the statute’s scope to cover paper files, adds certain content requirements for the notice to affected individuals, and adds an obligation to notify the Washington Attorney General for breaches involving more than 500 Washington residents. The new law also requires that notice to affected individuals be provided within 45 calendar days of discovering the breach unless an exception applies, authorizes the Washington Attorney General to enforce the statute, and expands the private right of action beyond “customers” to include “consumers.” The bill will be effective as of July 31, 2015. Washington is the third state to amend its data breach notification this year along with Montana and Wyoming.