---
title: "Set the incident facts against the statutory breach elements"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B15-4-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Set the incident facts against the statutory breach elements

> Place each fact from the log under one element of Civil Code section 1798.82: acquisition, encryption, personal information, and discovery date. Write no conclusion and no notice.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Place each fact from the log under one element of Civil Code section 1798.82: acquisition, encryption, personal information, and discovery date. Write no conclusion and no notice. |
| What the lawyer must review | Section 1798.82(g) defines a breach of the security of the system as unauthorised acquisition of computerised data that compromises the security, confidentiality, or integrity of personal information. Good-faith acquisition by an employee or agent for the business's purposes is not a breach if the information is not used or subject to further unauthorised disclosure. Whether this incident meets that definition, and whether notice is required, is your decision. The tool does not make it. HIPAA and other state statutes can apply at the same time and were not applied by this table. |
| Written for | United States |
| Applies to | [Prepare the file note deciding whether an AI-tool incident is a notifiable data breach](https://ailawframework.com/practice/privacy-data-protection-and-cyber/prepare-the-file-note-deciding-whether-an-ai-tool-incident-is-a-notifiab.md) |

## Checking plan

- What the AI does: Place each fact from the log under one element of Civil Code section 1798.82: acquisition, encryption, personal information, and discovery date. Write no conclusion and no notice.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not treat encryption as the end of the question. Read the encryption and key language in the section.
- The table is not a record that notice is, or is not, required.

## Sources

- [California Civil Code section 1798.82 (security breach disclosure)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.) (checked 2026-10-22)
- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*