Decide which entity notifies when personal information is held for another business
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Identify who collected the information, who stores it, and whose customers the people are. Quote the contract clause that allocates notice, then set it beside the FTC guide's instruction to notify the business on whose behalf the information was held.
- What the lawyer must review
- The United States pages opened here do not appoint one party as the assessor of a shared breach the way the Australian scheme does. The FTC guide says a business that collects or stores personal information on behalf of other businesses should notify those businesses of the breach, and should notify the institution that maintains an account if account-access information was stolen from a business that does not itself maintain the account. California's page places the resident-notice duty on the person or business in the circumstances section 1798.82(a) describes. The lawyer decides which entity has the state-law duty and whether the contract changes who sends the notice, not whether the duty exists.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.