Notice · Privacy, Data Protection & Cyber
California security breach notice
Notice to a California resident under Civil Code § 1798.82, using the statutory title and headings. It leaves the facts in brackets. It does not decide that notice is required, and it is not the model form printed in the statute.
- Kind
- Notice. A formal notice to serve or publish.
- Where it applies
- United States
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the 2 authorities it cites, for United States.
- Version
- 1
- Source
- Written for this library
When to use it
Use when the lawyer has decided that section 1798.82 requires notice to a California resident. Do not use it before that decision. Do not use the CCPA definition of personal information. Do not send it to an email account whose login credentials are the information that was breached.
Used for these tasks
- Assess a suspected data breach and draft the notification pack
- Build a 48-hour incident chronology from the tickets and emails
- Draft a data-breach incident response plan
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may place facts the lawyer has already confirmed under the statutory headings and calculate the 30-day and 15-day dates. The lawyer decides whether notice is required and approves every sentence before it is sent.
AI may
- Place confirmed facts under the headings in section 1798.82(d)(1)
- Calculate 30 calendar days from discovery or notification, and 15 calendar days from consumer notice for an Attorney General sample
- Check a draft against the content list in section 1798.82(d)(2) and mark gaps
AI must not
- Must not decide that notice is required, or that an exception applies
- Must not send the notice, or address it to the email account whose credentials were breached
- Must not describe CCPA personal information as if it were section 1798.82 personal information
The lawyer checks
- The facts meet section 1798.82(a) or the notice is not sent, including encryption and the key or credential
- The title, the five headings, 10-point type and the paragraph (2) contents are present
- More than 500 California residents triggers the Attorney General sample within 15 calendar days, and other states are handled under their own statutes
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Cross-border disclosure of personal information under APP 8
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- OAIC privacy complaint form
- CCPA privacy policy
- Incident response plan outline
- Use or disclosure of personal information under APP 6
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- OAIC privacy complaint authorised representative form
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Breach notice with a statute checklist
- Notice at collection
- Security and destruction of personal information under APP 11
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Consumer request response
- Service-provider safeguards addendum
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Critical infrastructure cyber incident reporting clocks
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area