<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: conducting-regulatory-breach-notification
description: >-
  Conducts regulatory breach notification processes including GDPR 72-hour
  notification, CCPA disclosure, HIPAA breach reporting, SEC material incident
  disclosure, and multi-jurisdiction coordination for data breach incidents.
domain: cybersecurity
subdomain: incident-response
tags:
  - breach-notification
  - GDPR
  - CCPA
  - HIPAA
  - SEC-disclosure
  - regulatory-compliance
  - data-breach
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Conducting Regulatory Breach Notification

## Overview

When a security incident involves personal data exposure, regulatory breach
notification obligations trigger with strict timelines. Missing a notification
deadline can result in penalties exceeding the cost of the breach itself (GDPR
fines up to 4% of global revenue). This skill covers notification requirements
across GDPR, CCPA/CPRA, HIPAA, SEC, and state breach notification laws, including
assessment criteria, notification templates, and multi-jurisdiction coordination.

Key principle: breach notification assessment must run **in parallel** with
technical incident response, not after it. Legal counsel involvement from hour
one is essential.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Legal counsel | Regulatory interpretation | External or in-house |
| DPA contact registry | Supervisory authority contacts | Pre-compiled |
| Breach notification tracker | Multi-jurisdiction tracking | Spreadsheet or GRC tool |
| Privacy impact assessment | Data classification reference | Existing DPIA inventory |
| Communication templates | Pre-approved notification text | Legal-approved templates |

## Key Concepts

### Notification Timeline Requirements

| Regulation | Timeline | Notify Whom | Threshold |
|------------|----------|-------------|-----------|
| GDPR Art. 33 | 72 hours | Supervisory Authority (DPA) | Risk to individuals |
| GDPR Art. 34 | Without undue delay | Data subjects | High risk to individuals |
| CCPA/CPRA | Most expedient time | California AG + consumers | Unencrypted PI of 500+ CA residents |
| HIPAA | 60 days | HHS + individuals | Unsecured PHI of any count |
| HIPAA (500+) | 60 days | HHS + individuals + media | 500+ individuals in a state |
| SEC (8-K) | 4 business days | SEC filing | Material cybersecurity incident |
| State laws | Varies (30-90 days) | State AG + individuals | State-specific thresholds |

### Breach Assessment Questions

```
1. Was personal data involved? (Yes → continue assessment)
2. What categories of data? (Names, SSN, financial, health, credentials)
3. How many individuals affected?
4. Were the data encrypted at rest and in transit?
5. Is there evidence of actual access/exfiltration? (vs. exposure only)
6. What is the likely impact on affected individuals?
7. Which jurisdictions are affected? (residence of data subjects)
8. Are any special categories involved? (health, biometric, children)
```

### GDPR Risk Assessment Matrix

| Factor | Low Risk | High Risk |
|--------|----------|-----------|
| Data type | Name + email | SSN + financial + health |
| Encryption | Data was encrypted | Data unencrypted |
| Volume | < 100 individuals | > 10,000 individuals |
| Access evidence | No evidence of access | Confirmed exfiltration |
| Mitigation | Immediate containment | Extended exposure period |

## Workflow

### Step 1 — Assess Notification Obligation

```
BREACH NOTIFICATION ASSESSMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Incident ID:        INC-2026-0342
Assessment Date:    2026-03-17T20:00:00Z
Assessor:           [Privacy Officer / Legal Counsel]

DATA INVOLVED
Personal data:      [Yes/No]
Categories:         [Names, emails, SSNs, financial, health records]
Special categories: [Yes/No — Art. 9 GDPR data]
Encrypted:          [Yes/No — at rest and in transit]
Volume:             [estimated count of affected individuals]

JURISDICTIONS
EU residents:       [Yes/No — which member states]
California:         [Yes/No — count of CA residents]
HIPAA covered:      [Yes/No — PHI involved]
SEC material:       [Yes/No — material impact assessment]
Other states:       [list jurisdictions]

ACCESS ASSESSMENT
Evidence of access: [Confirmed / Suspected / No evidence]
Exfiltration:       [Confirmed / Suspected / Ruled out]
Dwell time:         [duration of exposure]
Containment:        [Contained / In progress]

DETERMINATION
Notification required: [Yes / No / Under assessment]
Jurisdictions:         [list]
Clock started:         [timestamp — when breach was confirmed]
Deadlines:             [by jurisdiction]
```

### Step 2 — GDPR Supervisory Authority Notification

```
GDPR ARTICLE 33 NOTIFICATION TO DPA
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
To: [Relevant Data Protection Authority]
Date: [within 72 hours of becoming aware]

1. NATURE OF THE BREACH
Description: [type of breach — confidentiality/integrity/availability]
Categories of data: [personal data categories affected]
Approximate records: [number of data records]
Approximate individuals: [number of data subjects]

2. DATA PROTECTION OFFICER CONTACT
Name: [DPO name]
Email: [DPO email]
Phone: [DPO phone]

3. LIKELY CONSEQUENCES
[Description of likely consequences for data subjects]

4. MEASURES TAKEN
[Description of measures taken or proposed to address the breach,
including measures to mitigate possible adverse effects]

5. ADDITIONAL INFORMATION
[Will be provided as investigation continues — Art. 33(4)]
```

### Step 3 — Notify Affected Individuals (if required)

```
INDIVIDUAL NOTIFICATION TEMPLATE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Subject: Important Security Notice from [Company]

Dear [Name],

We are writing to inform you of a security incident that may have
affected your personal information.

WHAT HAPPENED
[Brief, clear description of the incident]

WHAT INFORMATION WAS INVOLVED
[Specific data types affected for this individual]

WHAT WE ARE DOING
[Steps taken to respond and prevent recurrence]

WHAT YOU CAN DO
- [Specific protective actions — change passwords, monitor accounts]
- [Credit monitoring offer if applicable]
- [Dedicated support contact]

CONTACT INFORMATION
[Dedicated incident response contact — phone, email, website]

[Company Name]
[Date]
```

### Step 4 — Track Multi-Jurisdiction Deadlines

```bash
# Notification tracking register
cat <<'EOF'
NOTIFICATION TRACKING — INC-2026-0342
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Jurisdiction | Regulation | Deadline | Status | Filed |
|-------------|------------|----------|--------|-------|
| EU (Ireland) | GDPR Art. 33 | 2026-03-20T20:00Z | PENDING | — |
| EU (Germany) | GDPR Art. 33 | 2026-03-20T20:00Z | PENDING | — |
| California | CCPA | ASAP | PENDING | — |
| New York | SHIELD Act | ASAP | PENDING | — |
| SEC | 8-K Item 1.05 | 2026-03-23 | ASSESSING | — |
| HHS/OCR | HIPAA | 2026-05-16 | ASSESSING | — |
EOF
```

### Step 5 — Document Decision Trail

```
NOTIFICATION DECISION LOG
━━━━━━━━━━━━━━━━━━━━━━━━
2026-03-17 15:30 — Breach confirmed, notification clock starts
2026-03-17 16:00 — Legal counsel engaged, privacy team activated
2026-03-17 18:00 — Initial data scope assessment: ~15,000 individuals
2026-03-17 20:00 — GDPR notification determination: REQUIRED (high risk)
2026-03-17 20:30 — DPO drafts Art. 33 notification
2026-03-18 08:00 — Legal review of notification complete
2026-03-18 10:00 — Art. 33 notification submitted to Irish DPC
2026-03-18 12:00 — CCPA assessment: notification required (>500 CA residents)
2026-03-18 14:00 — Individual notification template approved by legal
2026-03-19 09:00 — Individual notifications sent via secure email
```

## Verification

- [ ] Breach notification assessment completed within 24 hours of confirmation
- [ ] Legal counsel engaged from the start of breach assessment
- [ ] All affected jurisdictions identified and mapped to regulations
- [ ] GDPR Art. 33 notification filed within 72 hours (if applicable)
- [ ] GDPR Art. 34 individual notification sent (if high risk)
- [ ] CCPA/state AG notifications filed per jurisdiction requirements
- [ ] SEC materiality assessment completed (if publicly traded)
- [ ] HIPAA notification timeline tracked (if PHI involved)
- [ ] All notification decisions documented with timestamps
- [ ] Individual notifications include required elements per regulation

## References

- GDPR Articles 33-34: Notification of Personal Data Breach
- CCPA Section 1798.82: Breach Notification Requirements
- HIPAA Breach Notification Rule: 45 CFR Parts 160 and 164
- SEC Final Rule: Cybersecurity Risk Management (Item 1.05 of Form 8-K)
- IAPP Breach Notification Tool: https://iapp.org/resources/article/us-state-data-breach-notification-chart/
- EDPB Guidelines 01/2021 on Examples regarding Data Breach Notification
