On March 26, 2020, Washington D.C. enacted bill number B23-0215, amending its data breach notification law.

In addition to the data breach notification requirements (including medical and biometric data when compromised together with a person’s name) the bill also requires businesses to:

  • “Implement and maintain reasonable security safeguards, including procedures and practices that are appropriate