---
title: "Assess a suspected data breach and draft the notification pack"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack"
type: "task"
site: "AI Law Framework"
id: "A25-T1-R3"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
last_reviewed: "2026-09-28"
---

# Assess a suspected data breach and draft the notification pack

> The statement to the regulator and the notice to individuals are the lawyer's to write and the tool writes no part of either.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack  
Last reviewed: 2026-09-28

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | The statement to the regulator and the notice to individuals are the lawyer's to write and the tool writes no part of either. Organise the incident record into a source-referenced assessment table — what was accessed, whose information and which systems, every row referenced to the document or log it comes from and set beside the statutory serious-harm factors with a column for each factor — and list the facts that still need a source, the notification route chosen, and whether any other entity is being treated as covered by this notification. Check the lawyer's own statement against each prescribed content item and the regulator's notification form, compare the notice to individuals against that statement and flag anything the statement says that the notice does not carry, and flag anything the drafts assert that the incident record does not support, or that the two drafts say differently. |
| What the lawyer must review | Decide whether the incident is notifiable under the current statute. Deadlines and 'serious harm' are lawyer calls, and so are the notification route and whether any other entity is covered by this notification. The lawyer writes the statement to the regulator and the notice to individuals, and confirms every fact and every remediation step asserted in them is true at the moment of issue. |
| Written for / versions | 3 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

- What the AI does: From the incident facts, build an assessment table (what was accessed, whose information, what harm is likely) and a first-draft regulator and individual notice.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [Commonwealth](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/commonwealth.md) | Red |
| [New Zealand](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/new-zealand.md) | Red |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/united-states.md) | Red |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*