If your database is breached and you have more than 500 California residents in that database you are required to send notice of the breach to them under the California Data Security Breach Act...
Data Security Breach Reporting | State of California - Department of Justice - Kamala D. Harris Attorney General
Failure to do so means possible fines and being the defendant in a class action lawsuit.