---
title: "Decide who is told about a security breach of personal information"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-13-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Decide who is told about a security breach of personal information

> Build a notice list with three columns from the facts: law enforcement, other businesses that hold the affected accounts or on whose behalf the information was stored, and the affected individuals.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Build a notice list with three columns from the facts: law enforcement, other businesses that hold the affected accounts or on whose behalf the information was stored, and the affected individuals. Add the California Attorney General only if the California resident count is above the threshold on that page. |
| What the lawyer must review | The FTC guide says that when a business has a data breach it should notify law enforcement, other affected businesses, and affected individuals. If account numbers were taken but the business does not maintain the accounts, notify the institution that does. If the business collects or stores personal information on behalf of other businesses, notify those businesses. State breach laws typically say what the notice to individuals must and must not contain, and the guide says to consult the law-enforcement contact about timing so the notice does not impede the investigation. On the California page, the resident notice is required for unencrypted personal information acquired by an unauthorized person, and a sample goes to the Attorney General when more than 500 California residents must be notified. |
| Written for | United States |
| Applies to | [Decide who is told about an eligible data breach](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach.md) |

## Checking plan

- What the AI does: Build a notice list with three columns from the facts: law enforcement, other businesses that hold the affected accounts or on whose behalf the information was stored, and the affected individuals. Add the California Attorney General only if the California resident count is above the threshold on that page.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The FTC guide recommends telling people the steps they can take, pointing people whose Social Security numbers were taken to a fraud alert or credit freeze, and describing how the business will contact them later.
- There is no single federal consumer-notice statute on these two pages. Other states use their own definitions and timing.

## Sources

- [Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [California Attorney General: Data Security Breach Reporting](https://oag.ca.gov/privacy/databreach/reporting) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*