The common assumption is that Washington requires every business to encrypt every customer record. It does not impose one blanket encryption rule on all businesses. The rules turn on what information you handle, what your business does, and whether a sector-specific law or contract applies.
That distinction matters in practice. For many Washington businesses, encryption is especially important because it can affect whether a data breach triggers notice duties. For some businesses—such as covered financial institutions and health care organizations—separate rules can make encryption part of a required security program.
Washington does not set one encryption rule for every business
Washington’s main breach-notification law is chapter 19.255 RCW, the statute titled Personal Information—Notice of Security Breaches. It does not direct every business to encrypt all personal information at all times. Instead, the law defines when personal information is considered secured and when a business must notify people after a breach. You can read the current text of chapter 19.255 RCW.
Washington defines secured information as information encrypted to a standard that meets or exceeds the National Institute of Standards and Technology standard, or otherwise changed so an unauthorized person cannot read, use, or decipher it. The definition is functional: the protection must make the information unusable to the intruder. Merely labeling a file encrypted does not settle the question if the attacker also obtained the key or another way to decrypt it. RCW 19.255.005(3).
There is a separate state obligation for certain consumer health data. The Washington My Health My Data Act requires covered regulated entities and small businesses to limit access to consumer health data and maintain administrative, technical, and physical safeguards that meet at least the reasonable standard of care in their industry. The statute does not name encryption as a universal, stand-alone requirement. Whether encryption is a reasonable safeguard depends on the information and the risk. The requirements became applicable to regulated entities on March 31, 2024, and to small businesses on June 30, 2024. See RCW 19.373.050.
So the careful answer is not “Washington requires encryption for everyone” or “encryption is optional.” A general statewide rule prescribing encryption for every business is not the same thing as a duty to protect particular data reasonably or a sector-specific rule that expressly requires encryption.
Where encryption changes breach-notice duties
Under Washington’s breach statute, a business that owns or licenses covered personal information generally must notify affected Washington residents if an unauthorized person acquired it and it was not secured. The law also recognizes an important exception: no notice is required if the breach is not reasonably likely to create a risk of harm to consumers. Even encrypted information can require notice if the attacker acquired the confidential encryption process, key, or other means of deciphering it. Those rules appear in RCW 19.255.010.
The statute’s definition of personal information is specific. It includes certain combinations, such as a person’s name together with a Social Security number, driver’s license number, financial-account access information, full date of birth, health or medical information, or identifying biometric data. It also covers login credentials that would permit access to an online account. Some listed data elements can qualify without a person’s name when they remain usable and could enable identity theft. Encryption, redaction, or another method that renders the data unusable can affect whether those elements meet the definition. See RCW 19.255.005.
In plain terms, effective encryption can help keep an incident from becoming a reportable breach under the state statute. It is not a free pass. The business still needs to determine what was accessed, whether the data was actually protected, who had the keys, and whether the law’s risk-of-harm exception applies. A password-protected file, a locked laptop, or a secure cloud account is not automatically equivalent to encrypted data under the statute.
If notice is required, Washington generally requires notice to affected consumers as soon as possible, without unreasonable delay, and no later than 30 calendar days after discovery, subject to specified exceptions, including a law-enforcement delay or time needed to determine the breach’s scope and restore system integrity. If more than 500 Washington residents must be notified, the business must also notify the attorney general no more than 30 days after discovering the breach. A business holding data for someone else must notify the data owner or licensee immediately after discovering a qualifying breach. The statute sets out the timing and notice details in RCW 19.255.010.
Some businesses have more specific encryption duties
Health care providers and their business associates
HIPAA applies to covered health care providers, health plans, health care clearinghouses, and their business associates—not to every company that happens to hold health-related information. Under the federal HIPAA Security Rule, encryption and decryption for electronic protected health information are “addressable” implementation specifications for stored data. Encryption during electronic transmission is also addressable. That term does not mean a covered organization can ignore the safeguard. The organization must assess whether it is reasonable and appropriate for its environment; if it is not, it must document why and use an equivalent alternative measure when reasonable and appropriate. See 45 C.F.R. § 164.312 and 45 C.F.R. § 164.306.
That distinction is worth keeping straight. HIPAA does not simply say that every device containing electronic health information must use one prescribed encryption method in every circumstance. It does require a real, documented security analysis and appropriate protections. If you are a business associate, your agreement with a provider may also require specific encryption practices beyond the regulation’s baseline.
Financial businesses covered by the FTC Safeguards Rule
The federal FTC Safeguards Rule applies to financial institutions under FTC jurisdiction, a category broader than banks in ordinary conversation. The FTC identifies examples such as mortgage brokers, finance companies, tax preparers, and certain debt-related businesses. Covered institutions must maintain a written information-security program, and the regulation requires them to encrypt customer information at rest and in transit over external networks. If encryption is infeasible, the rule allows effective alternative compensating controls reviewed and approved by the qualified individual overseeing the program. See 16 C.F.R. § 314.4 and the FTC’s Safeguards Rule business guide.
Other financial institutions may be overseen by a different federal regulator and subject to that regulator’s rules. Do not assume that a business is outside financial data-security regulation just because it does not call itself a bank.
Businesses handling large volumes of payment-card transactions
Washington has a narrower payment-card liability provision. It defines a covered “business” for that section as an entity that processes more than six million credit- and debit-card transactions annually and serves Washington residents. Under RCW 19.255.020, qualifying businesses, processors, and vendors are not liable under that section if the specified account information was encrypted at the time of the breach or if the entity had qualifying, current PCI Security Standards Council compliance. This is a limited protection concerning the statute’s payment-card liability—not a general encryption command or immunity from every other claim. See RCW 19.255.020.
PCI DSS requirements can also reach a business through payment-card network rules, processor terms, or customer contracts. Those obligations are not the same as a Washington statute requiring every merchant to encrypt every category of business data.
What encryption does—and does not—protect you from
Encryption is a safeguard, not a substitute for the rest of a security program. It can reduce the chance that someone who steals a device or intercepts data can read it. It does not, by itself, prevent an employee with authorized access from misusing information, stop an attacker who compromises a live account, or establish that the business met every legal duty. Key management matters: keep decryption keys protected, limit who can use them, and avoid storing keys alongside the data they unlock.
Encryption also does not erase contract obligations. A customer agreement, business-associate agreement, cyber-insurance policy, or payment-processor contract can require controls that go beyond the general Washington statute. Read the actual wording, including what data must be encrypted, when, and what evidence of compliance the other party expects.
A practical way to check your obligations
List the information you hold. Identify personal information, health data, payment-card data, and financial customer information. Note where each type is stored, transmitted, backed up, and accessed—including by vendors.
Identify the rules that attach to your work. Ask whether your business is covered by HIPAA, the FTC Safeguards Rule, the My Health My Data Act, Washington’s breach statute, a payment-card provision, or a customer contract. The answer can differ between business units or data sets.
Check encryption and key access in real settings. Review laptops, phones, databases, backups, email transfers, and cloud storage. Confirm not just whether encryption is enabled, but who controls the keys and whether the data remains protected if a device or account is compromised.
Write down the reasoning. Keep a record of the data covered, risks considered, safeguards selected, exceptions, and any alternative controls. Documentation is especially important where a rule requires a risk assessment or permits an alternative to encryption.
Set vendor expectations before sharing data. Contracts should address security safeguards, incident reporting, cooperation with breach investigations, and the return or deletion of information. Washington’s My Health My Data Act, where it applies, also requires covered processors to work under a binding contract with processing instructions and limits. See RCW 19.373.060.
Plan for the day something goes wrong. Preserve logs and system records, identify who controls the encryption keys, and promptly determine what data was acquired and whether it could be deciphered. The notice clock can run quickly, so a written response plan should make responsibility clear before an incident.
A quick example
Imagine a Tacoma retailer loses a laptop containing customer files. The drive was encrypted, but an employee had written the recovery key on a note in the laptop case. The retailer cannot treat the word “encrypted” as the end of the inquiry. It needs to determine whether the laptop and key were both taken, what personal information was involved, and whether the data was accessible to the finder. If the key was not exposed and the encryption left the information unusable, the breach-notice analysis may come out differently than if the key traveled with the laptop. The facts—not the company’s security-policy label—drive the result.
The takeaway
For an ordinary Washington business, state law does not impose one across-the-board encryption mandate. Washington’s breach statute makes effective encryption important to the notice analysis, and the My Health My Data Act requires reasonable security practices for covered consumer health data. Federal rules can go further for covered health and financial businesses, while payment-card contracts and other agreements may add their own requirements. Start with the data and the business activity, then apply the rule that actually covers them.
Disclaimer: This guide provides general legal information and is not legal advice. Laws vary by state and may change over time. The outcome of any legal issue depends on the specific facts, documents, and circumstances involved. For advice about your situation, consult a qualified attorney licensed in your jurisdiction.