<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Regulatory Breach Notification — API Reference

## Notification Timelines

### GDPR (Articles 33-34)

```
Art. 33 — DPA Notification:
  Deadline: 72 hours from "becoming aware"
  Who: Lead Supervisory Authority
  Content: Nature, categories, approximate numbers, DPO contact,
           likely consequences, measures taken

Art. 34 — Individual Notification:
  Deadline: "Without undue delay" (when high risk)
  Who: Affected data subjects
  Content: Clear plain language description, DPO contact,
           likely consequences, measures taken + recommended actions
  Exceptions: Encrypted data, subsequent measures eliminating risk,
              disproportionate effort (use public communication instead)
```

### CCPA/CPRA

```
AG Notification: "Most expedient time possible" — 500+ CA residents
Individual: Written or electronic notice
Content: What happened, what info, what we're doing,
         what you can do, contact information
```

### HIPAA

```
Individual: Within 60 days of discovery
HHS OCR: Within 60 days (500+), annual log (< 500)
Media: Without unreasonable delay (500+ in single state)
Content: Description, types of info, protective steps,
         mitigation steps, contact procedures
```

### SEC Form 8-K

```
Deadline: 4 business days after materiality determination
Content: Material aspects of nature, scope, timing,
         material impact or reasonably likely material impact
Filing: EDGAR system — Item 1.05
```

## DPA Contact Registry

| Authority | Country | Portal |
|-----------|---------|--------|
| Irish DPC | Ireland | https://forms.dataprotection.ie/contact |
| ICO | UK | https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/ |
| CNIL | France | https://notifications.cnil.fr/notifications/ |
| BfDI | Germany | https://www.bfdi.bund.de |
| AEPD | Spain | https://sedeagpd.gob.es |

## HHS OCR Breach Portal

```bash
# HIPAA Breach Reporting
# Portal: https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf
# API not available — manual submission required
# For 500+ individuals: also notify prominent media in the state
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `72 hours` | GDPR DPA notification deadline | From awareness |
| `60 days` | HIPAA notification deadline | From discovery |
| `4 business days` | SEC 8-K filing deadline | From materiality determination |
| `500` | CCPA AG notification threshold | CA residents affected |
| `High risk` | GDPR Art. 34 trigger | Individual notification required |
