Breach notice with a statute checklist

When to use it

Use when counsel has decided a notice may have to go out and needs the letter and the statute checklist in one place. Do not send it until the lawyer ticks the box that applies and deletes the rest. It is not a California notice.

Used for these tasks

• Assess a suspected data breach and draft the notification pack
• Build a 48-hour incident chronology from the tickets and emails

Each task page says how far AI may help with the task and what the lawyer must review.

How AI may be used

AI may place facts the lawyer has already confirmed under the heading for the statute the lawyer ticks. The lawyer decides whether notice is required and which statute applies.

Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.

Authorities

• 45 CFR § 164.404 (notice to individuals)
• 45 CFR § 164.408 (notice to the Secretary)
• 45 CFR § 164.410 (a business associate's notice to the covered entity)
• N.Y. Gen. Bus. Law § 899-aa (notice to New York residents and to stated state agencies; text opened on the Senate site)
• FTC, Data Breach Response: A Guide for Business (suggested headings; the guide says state law controls what the notice must and must not say)
• 16 CFR § 314.4(j) (FTC notice by a financial institution covered by part 314, if a notification event involves at least 500 consumers)

More in Privacy, Data Protection & Cyber

• Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
• Cross-border disclosure of personal information under APP 8
• Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
• Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
• OAIC privacy complaint form
• CCPA privacy policy
• Incident response plan outline
• Use or disclosure of personal information under APP 6
• Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
• OAIC privacy complaint authorised representative form
• Notifiable data breach statement to the OAIC: completion guide for the online form
• Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
• Notice at collection
• Security and destruction of personal information under APP 11
• Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
• APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
• Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
• Consumer request response
• Service-provider safeguards addendum
• Collection notice (APP 5) for forms, websites, apps and call scripts
• De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
• Critical infrastructure cyber incident reporting clocks
• Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
• California security breach notice
• Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
• AI and automated decisions clause for privacy policies and collection notices
• Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)

All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area