Gov. Code, § 8231.15

(a) An online notarization platform or depository shall not have access to a notary public’s electronic signature or electronic seal.

(b) An online notarization platform or depository shall not access, use, share, sell, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the contents of the notary public’s electronic journal, except to comply with any other applicable federal, state, or local law, a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.

(c) An online notarization platform or depository shall not access, use, share, sell, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the contents of a document notarized by a notary public absent express written request from the principal or to comply with any other applicable federal, state, or local law, a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.

(d) An online notarization platform or depository shall not access, use, share, sell, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the contents of an audio-video recording of an online notarial act absent express written request from the principal or to comply with any other applicable federal, state, or local law, a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.

(e) An online notarization platform or depository shall not access, use, share, sell, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the personal information of a principal absent express written request from the principal or to comply with any other applicable federal, state, or local law, a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.

(f) Notwithstanding subdivisions (a), (b), (c), (d), and (e), an online notarization platform or depository may access, use, share, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the notary public’s electronic signature or electronic seal, the contents of the notary public’s electronic journal, the contents of a notarized document or audio-video recording, or the personal information of a principal, to the extent necessary to do any of the following:

(1) Facilitate the performance of an online notarial act.

(2) Comply with the requirements of Article 1 (commencing with Section 8200), this article, rules and regulations adopted by the Secretary of State pursuant to this article, or any other applicable federal, state, or local law, or a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.

(3) Administer, affect, enforce, or process a record provided by or on behalf of a principal or the transaction of which the record is a part.

(4) As necessary to implement the requirements of this article and any rules or regulations adopted by the Secretary of State and to implement the fraud mitigation measures as outlined in NIST Special Publication 800-63A, dated June 2017, promulgated by the National Institutes of Standards and Technology, or any successor publication.

(g) An online notarization platform or depository shall, in the most expedient time possible and without unreasonable delay, notify the Secretary of State, using a notification process designated by the Secretary of State, all appropriate law enforcement agencies, any affected online notaries public, and any affected principals, of the unauthorized access or use by or disclosure to another person, loss, compromise, theft, vandalism, corruption, or breach of any of the following:

(1) A notary public’s electronic signature or electronic seal.

(2) A notary public’s electronic journal.

(3) Any records of online notarial acts.