Decide who is told about a security breach of personal information
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Build a notice list with three columns from the facts: law enforcement, other businesses that hold the affected accounts or on whose behalf the information was stored, and the affected individuals. Add the California Attorney General only if the California resident count is above the threshold on that page.
- What the lawyer must review
- The FTC guide says that when a business has a data breach it should notify law enforcement, other affected businesses, and affected individuals. If account numbers were taken but the business does not maintain the accounts, notify the institution that does. If the business collects or stores personal information on behalf of other businesses, notify those businesses. State breach laws typically say what the notice to individuals must and must not contain, and the guide says to consult the law-enforcement contact about timing so the notice does not impede the investigation. On the California page, the resident notice is required for unencrypted personal information acquired by an unauthorized person, and a sample goes to the Attorney General when more than 500 California residents must be notified.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.