Draft a data-breach incident response plan
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List the systems the client names, the notice statutes the lawyer has opened, and the statutory headings those statutes require a notice to be able to fill. Write no sentence of the plan. Do not decide that any past incident is notifiable.
- What the lawyer must review
- The FTC's Data Breach Response Guide tells a business to secure systems, consult counsel, notify law enforcement, and notify affected individuals, and it points to state breach laws for what the notice must and must not say. It also flags the FTC Health Breach Notification Rule and the HIPAA Breach Notification Rule where health records are involved. California Civil Code section 1798.82 requires a person who owns or licenses computerised data to notify a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorised person, generally within 30 calendar days of discovery, unless law enforcement or the scope-and-restore delay applies. The notice must be titled "Notice of Data Breach" and use the statutory headings. HIPAA notice to individuals is without unreasonable delay and no later than 60 days after discovery, with media notice if more than 500 residents of a state or jurisdiction are affected, and notice to the Secretary on the 500-person split. The plan is adopted by the client. Check every deadline against the statute that actually applies.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes organising research leads. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Incident response plan outline | Checklist | AI use Yellow | An outline for a written incident response plan, arranged on the six functions in NIST SP 800-61r3. |
| California security breach notice | Notice | AI use Yellow | Notice to a California resident under Civil Code § 1798.82, using the statutory title and headings. |
Signed-in accounts can read the full text of each one. All precedents.