---
title: "Security incident clause"
url: "https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-security-incident-clause"
type: "precedent"
site: "AI Law Framework"
id: "a24-us-security-incident-clause"
area_id: "A24"
kind: "clause"
ai_level: "yellow"
version: 1
task_ids: ["A24-T1-R6", "A24-B7-4"]
law_stated_as_at: "2026-10-22"
---

# Security incident clause

> Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule.…

Canonical page: https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-security-incident-clause  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

Contract clause that makes a vendor who holds computerized personal information notify the customer immediately, using the California statute's maintainer rule. It does not notify residents and it does not decide that notice is required.

## Key facts

- Kind: Clause. Wording to drop into a longer document.
- Practice area: [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for United States.

## When to use it

Use in a services, hosting or outsourcing contract where the vendor holds data the customer owns or licenses. Do not use it as the letter to residents. Do not use the CCPA definition of personal information in place of Civil Code § 1798.82.

## Used for these tasks

- [Draft or review security and incident-notification clauses](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/draft-or-review-security-and-incident-notification-clauses.md)
- [Prepare an incident-response checklist for an AI system](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-an-incident-response-checklist-for-an-ai-system.md)

## How AI may be used

AI may insert this clause and fill the notice address from the order. The lawyer decides who owns or licenses the data, and whether any resident notice is required, outside this clause.

**AI may:**

- Insert the clause and the customer's notice address from the contract sheet
- Compare a vendor security clause with this one and list timing or content gaps
- Extract dates and systems from tickets into a chronology for the lawyer

**AI must not:**

- Must not decide that a breach has occurred or that resident notice is required
- Must not draft the notice to residents in this clause
- Must not swap in the CCPA definition of personal information

**The lawyer checks:**

- The vendor is the person who maintains data it does not own, or the clause is rewritten because the vendor owns or licenses the data
- The immediate-notice duty matches § 1798.82(b), and the 30-day resident clock stays with the owner or licensee
- Other states' breach statutes are checked separately. This clause does not cover them

## Authorities

- [California Civil Code § 1798.82 (breach of the security of the system)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-security-incident-clause and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*