---
title: "Prepare the facts for a breach notice to residents and the Attorney General sample"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B15-1-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Prepare the facts for a breach notice to residents and the Attorney General sample

> List the dates, the systems, and the categories the incident log already states, under the headings the statute uses. Write no sentence of a notice and no sentence of the sample sent to the Attorney General.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | List the dates, the systems, and the categories the incident log already states, under the headings the statute uses. Write no sentence of a notice and no sentence of the sample sent to the Attorney General. |
| What the lawyer must review | Section 1798.82 requires notice to a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorised person. The notice is titled "Notice of Data Breach" and uses the headings What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. When one breach requires notice to more than 500 California residents, a single sample copy, excluding personally identifiable information, must be submitted electronically to the Attorney General within 15 calendar days of notifying the consumers. You write both documents. A generated notice is not the notice the client sends. |
| Written for | United States |
| Applies to | [Draft the statement to the OAIC about a notifiable data breach from the incident log](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the.md) |

## Checking plan

- What the AI does: List the dates, the systems, and the categories the incident log already states, under the headings the statute uses. Write no sentence of a notice and no sentence of the sample sent to the Attorney General.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The Attorney General sample is a copy of the consumer notice. It is not a separate investigation response.
- Open subdivision (h) before you decide which data elements are personal information for this section.

## Sources

- [California Civil Code section 1798.82 (security breach disclosure)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals.md) | Notice | Yellow | Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts,… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*