---
title: "Draft a data-breach incident response plan"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R4-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Draft a data-breach incident response plan

> List the systems the client names, the notice statutes the lawyer has opened, and the statutory headings those statutes require a notice to be able to fill. Write no sentence of the plan.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List the systems the client names, the notice statutes the lawyer has opened, and the statutory headings those statutes require a notice to be able to fill. Write no sentence of the plan. Do not decide that any past incident is notifiable. |
| What the lawyer must review | The FTC's Data Breach Response Guide tells a business to secure systems, consult counsel, notify law enforcement, and notify affected individuals, and it points to state breach laws for what the notice must and must not say. It also flags the FTC Health Breach Notification Rule and the HIPAA Breach Notification Rule where health records are involved. California Civil Code section 1798.82 requires a person who owns or licenses computerised data to notify a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorised person, generally within 30 calendar days of discovery, unless law enforcement or the scope-and-restore delay applies. The notice must be titled "Notice of Data Breach" and use the statutory headings. HIPAA notice to individuals is without unreasonable delay and no later than 60 days after discovery, with media notice if more than 500 residents of a state or jurisdiction are affected, and notice to the Secretary on the 500-person split. The plan is adopted by the client. Check every deadline against the statute that actually applies. |
| Written for | United States |
| Applies to | [Draft a data-breach incident response plan](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan.md) |

## Checking plan

- What the AI does: Turn the client's system list into a plan outline: who is called, which notice statute might apply, and the headings a notice must be able to fill. Do not decide that any past incident is notifiable.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- State breach statutes differ. California is the opened example, not a national rule.
- This is the plan. A live notification pack is a separate task and is already covered for this area.

## Sources

- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [California Civil Code section 1798.82 (security breach disclosure)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [HHS: HIPAA Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Incident response plan outline](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan.md) | Checklist | Yellow | An outline for a written incident response plan, arranged on the six functions in NIST SP 800-61r3. A Safeguards Rule plan is a separate box, and only if that rule applies. |
| [California security breach notice](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-california-breach-notice.md) | Notice | Yellow | Notice to a California resident under Civil Code § 1798.82, using the statutory title and headings. It leaves the facts in brackets.… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*