Template id: breach-notice-ca-ag-us.v1 owner: Lilith-Privacy lead + US
counsel deadline: notify affected California residents in the most
expedient time possible and without unreasonable delay; if more than 500
California residents are notified, submit a single sample copy of the notice
to the California Attorney General (electronic submission)
Trigger scope: unauthorized acquisition of unencrypted personal information (or encrypted where the key was also compromised) — the legal owner makes the encryption-safe-harbor call, never engineering alone.
Resident notice — required format (§1798.82(d))#
Plain language, titled "Notice of Data Breach", organized under these exact headings:
- What Happened — date(s) of breach, date discovered, general description.
- What Information Was Involved — the categories of personal information
(name plus SSN / driver's license / financial account, or
username-and-password credentials, etc., as scoped).
- V3 data-class mapping: account credentials (username/e-mail + password or security question) trigger §1798.82(d)(4) — that notice may direct the user to change passwords promptly; payment data follows the financial-account branch.
- What We Are Doing — containment, the forced credential rotation / family revocation already executed per the security runbook, and any services offered (if SSNs/driver's licenses involved: ≥12 months identity theft prevention/mitigation services, §1798.82(d)(2)(G)).
- What You Can Do — concrete steps; credit-reporting-agency contact info where applicable.
- For More Information — toll-free number / e-mail / postal address.
Delivery: written or electronic notice consistent with E-SIGN; substitute notice (site posting + statewide media + e-mail) only if counsel confirms the statutory cost/volume thresholds.
AG submission#
- Single sample copy of the resident notice, without personal information, via the AG's online breach reporting form, when >500 CA residents notified.
Internal routing#
- Drafted by: Lilith-Privacy lead. Reviewed by: US counsel (mandatory).
- "Without unreasonable delay" is interpreted in days, not weeks; delay is permitted only for legitimate law-enforcement needs or to determine scope and restore integrity — document the reason for every day between confirmation and notice.
- Evidence: sent notice, recipient count, AG submission receipt, and timestamps in the incident evidence bucket, referenced from the Operator Console case.