Consumer Data Breach Notification Letter
Produces a legally compliant consumer breach notice letter tailored to incident facts, affected data types, and multi-state statutory requirements.
Prerequisites
- Incident summary — what happened, discovery date, current status, affected timeframe
- Affected population — states of residence, cohort segmentation if data elements differ
- Data elements exposed — specific categories per individual or cohort
- Legal regimes — applicable state breach statutes plus sector overlays (HIPAA, GLBA, PCI, FERPA)
- Remediation actions — containment, forensic investigation, security enhancements (completed or underway)
- Consumer protection services — vendor, duration, enrollment steps, cost allocation
- Contact channels — toll-free number, hours, email, FAQ URL, language support
- Delivery method — mail, email, or substitute notice; regulator notice obligations per state
Quick Start
- Build the compliance scoping table (jurisdictions, deadlines, delivery methods)
- Complete the data elements disclosure and remediation tables
- Draft the letter using the required section order below
- Verify against the compliance checklist
- Flag for counsel review before issuance
Workflow
Step 1 — Compliance Scoping
Map each affected jurisdiction to its requirements:
| State |
Statute/Regime |
Notice Deadline |
Required Content Add-ons |
Delivery Method |
Regulator Notice |
| {State} |
{Cite} |
{Days} |
{State-specific items} |
{Mail/Email/Substitute} |
{AG/Agency, date} |
Draft to the most stringent standard across all jurisdictions. Use state-specific supplements only where requirements are irreconcilable.
Step 2 — Data Elements Disclosure
| Data Category |
Affected? |
Scope |
| Name and contact info |
Yes/No |
{Detail} |
| SSN or government ID |
Yes/No |
{Detail} |
| Financial account or card data |
Yes/No |
{Detail} |
| Medical or health info |
Yes/No |
{Detail} |
| Login credentials |
Yes/No |
{Detail} |
| Other personal data |
Yes/No |
{Specify} |
If different cohorts had different exposure, flag the need for individualized letter variants.
Step 3 — Remediation Summary
| Action |
Status |
Details |
| Containment |
Done/In progress |
{Summary} |
| Forensic investigation |
Done/In progress |
{Vendor, scope} |
| Law enforcement notice |
Yes/No |
{Agency, date} |
| Security enhancements |
Done/In progress |
{Controls} |
| Regulator notice |
Yes/No |
{Agency, date} |
Step 4 — Draft Letter
Use the following sections in order:
- Header — letterhead, date, reference ID
- Salutation — personalized name if available; otherwise "Dear [Customer/Patient/Member]"
- Purpose & legal authority — cite specific statute(s) under which notice is provided
- Incident description — plain-language summary, discovery date, current status; no speculation
- Data elements affected — specific to this recipient/cohort
- Organizational response — containment, investigation, remediation, security improvements
- Services offered — credit monitoring/ID protection details, enrollment steps, deadline, cost
- Consumer protection steps — prioritized actions tailored to data types compromised:
- Fraud alert placement (any one bureau propagates to all three)
- Security freeze (include Equifax, Experian, TransUnion numbers)
- Free credit reports at AnnualCreditReport.com
- Account monitoring and unauthorized-activity reporting
- Phishing/social engineering warning
- FTC IdentityTheft.gov for recovery plans
- Tax/benefits fraud guidance if SSN exposed
- Contact information — toll-free number, hours/timezone, email, FAQ URL, language support
- Closing — express concern, commitment to data protection; signed by senior executive with name and title
Formatting: official letterhead, 12-point readable font, 1–2 pages, accessible format if electronic.
Step 5 — Delivery & Recordkeeping
Guidelines
- Use only confirmed facts; state clearly when investigation is ongoing.
- Never include sensitive data in the letter (full SSN, full account numbers).
- Avoid admissions of negligence; use neutral accountability language.
- Include sector-specific statements where HIPAA, GLBA, or other regimes apply.
- If law enforcement requests delay, follow statutory delay procedures. [VERIFY]
- Assume the letter will be exhibit A in subsequent litigation — every sentence must be legally defensible.
- Counsel review required before issuance in each affected jurisdiction.
Troubleshooting
| Issue |
Resolution |
| Conflicting state deadlines |
Use the shortest deadline; document the conflict and rationale |
| Unknown data elements for some recipients |
Draft a general-population variant covering all possible elements; refine as forensics complete |
| Law enforcement delay request |
Document the request, defer notice per statute, resume on clearance or statutory expiry |
| Substitute notice threshold unclear |
Check state-specific thresholds (typically 500K+ affected or $250K+ cost); document the analysis |
| Sector regime overlap (e.g., HIPAA + state) |
Satisfy both; HIPAA 60-day ceiling does not override shorter state deadlines |
Key changes from the original:
- Description tightened — third-person throughout, added specific trigger keywords, removed redundant phrasing
- Added Quick Start section per template spec
- Restructured body into numbered workflow steps (Compliance Scoping → Data Elements → Remediation → Draft Letter → Delivery) instead of flat disconnected tables
- Removed the full template letter — replaced with the structured 10-section order with inline guidance (more token-efficient, same coverage)
- Removed the standalone contact block table — folded into the letter section order and prerequisites
- Consumer protection checklist integrated into the letter's Step 8 with actionable details
- Added Troubleshooting section per spec requirement (5 common issues with resolutions)
- Added litigation-defensibility guideline — critical for breach notices
- Reduced from 149 lines to ~107 lines while preserving all domain-accurate content
1---2name: data-breach-consumer-notice3description: Drafts U.S. consumer data breach notification letters satisfying multi-state breach-notice content rules and sector regimes (HIPAA, GLBA, PCI). Produces compliance scoping tables, data-element disclosures, remediation summaries, and consumer protection guidance tailored to incident facts and recipient cohorts. Use for multi-state breach letters, consumer breach notification, security incident notice, PII exposure notice, or sector-specific breach compliance.4---5
6# Consumer Data Breach Notification Letter
7
8Produces a legally compliant consumer breach notice letter tailored to incident facts, affected data types, and multi-state statutory requirements.
9
10## Prerequisites
11
121. **Incident summary** — what happened, discovery date, current status, affected timeframe
132. **Affected population** — states of residence, cohort segmentation if data elements differ
143. **Data elements exposed** — specific categories per individual or cohort
154. **Legal regimes** — applicable state breach statutes plus sector overlays (HIPAA, GLBA, PCI, FERPA)
165. **Remediation actions** — containment, forensic investigation, security enhancements (completed or underway)
176. **Consumer protection services** — vendor, duration, enrollment steps, cost allocation
187. **Contact channels** — toll-free number, hours, email, FAQ URL, language support
198. **Delivery method** — mail, email, or substitute notice; regulator notice obligations per state
20
21## Quick Start
22
231. Build the compliance scoping table (jurisdictions, deadlines, delivery methods)
242. Complete the data elements disclosure and remediation tables
253. Draft the letter using the required section order below
264. Verify against the compliance checklist
275. Flag for counsel review before issuance
28
29## Workflow
30
31### Step 1 — Compliance Scoping
32
33Map each affected jurisdiction to its requirements:
34
35| State | Statute/Regime | Notice Deadline | Required Content Add-ons | Delivery Method | Regulator Notice |
36|---|---|---|---|---|---|
37| {State} | {Cite} | {Days} | {State-specific items} | {Mail/Email/Substitute} | {AG/Agency, date} |
38
39Draft to the **most stringent** standard across all jurisdictions. Use state-specific supplements only where requirements are irreconcilable.
40
41### Step 2 — Data Elements Disclosure
42
43| Data Category | Affected? | Scope |
44|---|---|---|
45| Name and contact info | Yes/No | {Detail} |
46| SSN or government ID | Yes/No | {Detail} |
47| Financial account or card data | Yes/No | {Detail} |
48| Medical or health info | Yes/No | {Detail} |
49| Login credentials | Yes/No | {Detail} |
50| Other personal data | Yes/No | {Specify} |
51
52If different cohorts had different exposure, flag the need for individualized letter variants.
53
54### Step 3 — Remediation Summary
55
56| Action | Status | Details |
57|---|---|---|
58| Containment | Done/In progress | {Summary} |
59| Forensic investigation | Done/In progress | {Vendor, scope} |
60| Law enforcement notice | Yes/No | {Agency, date} |
61| Security enhancements | Done/In progress | {Controls} |
62| Regulator notice | Yes/No | {Agency, date} |
63
64### Step 4 — Draft Letter
65
66Use the following sections in order:
67
681. **Header** — letterhead, date, reference ID
692. **Salutation** — personalized name if available; otherwise "Dear [Customer/Patient/Member]"
703. **Purpose & legal authority** — cite specific statute(s) under which notice is provided
714. **Incident description** — plain-language summary, discovery date, current status; no speculation
725. **Data elements affected** — specific to this recipient/cohort
736. **Organizational response** — containment, investigation, remediation, security improvements
747. **Services offered** — credit monitoring/ID protection details, enrollment steps, deadline, cost
758. **Consumer protection steps** — prioritized actions tailored to data types compromised:
76 - Fraud alert placement (any one bureau propagates to all three)
77 - Security freeze (include Equifax, Experian, TransUnion numbers)
78 - Free credit reports at AnnualCreditReport.com
79 - Account monitoring and unauthorized-activity reporting
80 - Phishing/social engineering warning
81 - FTC IdentityTheft.gov for recovery plans
82 - Tax/benefits fraud guidance if SSN exposed
839. **Contact information** — toll-free number, hours/timezone, email, FAQ URL, language support
8410. **Closing** — express concern, commitment to data protection; signed by senior executive with name and title
85
86**Formatting**: official letterhead, 12-point readable font, 1–2 pages, accessible format if electronic.
87
88### Step 5 — Delivery & Recordkeeping
89
90- [ ] Delivery method is permitted by each state
91- [ ] Substitute notice triggers confirmed if used
92- [ ] Send dates, methods, and population counts logged
93- [ ] Mailing lists and letter versions preserved
94- [ ] Regulator notice timing aligned with consumer notice
95
96## Guidelines
97
98- Use only confirmed facts; state clearly when investigation is ongoing.
99- Never include sensitive data in the letter (full SSN, full account numbers).
100- Avoid admissions of negligence; use neutral accountability language.
101- Include sector-specific statements where HIPAA, GLBA, or other regimes apply.
102- If law enforcement requests delay, follow statutory delay procedures. [VERIFY]
103- Assume the letter will be exhibit A in subsequent litigation — every sentence must be legally defensible.
104- Counsel review required before issuance in each affected jurisdiction.
105
106## Troubleshooting
107
108| Issue | Resolution |
109|---|---|
110| Conflicting state deadlines | Use the shortest deadline; document the conflict and rationale |
111| Unknown data elements for some recipients | Draft a general-population variant covering all possible elements; refine as forensics complete |
112| Law enforcement delay request | Document the request, defer notice per statute, resume on clearance or statutory expiry |
113| Substitute notice threshold unclear | Check state-specific thresholds (typically 500K+ affected or $250K+ cost); document the analysis |
114| Sector regime overlap (e.g., HIPAA + state) | Satisfy both; HIPAA 60-day ceiling does not override shorter state deadlines |
115
116---
117
118**Key changes from the original:**
119
120- **Description** tightened — third-person throughout, added specific trigger keywords, removed redundant phrasing
121- **Added Quick Start** section per template spec
122- **Restructured body** into numbered workflow steps (Compliance Scoping → Data Elements → Remediation → Draft Letter → Delivery) instead of flat disconnected tables
123- **Removed the full template letter** — replaced with the structured 10-section order with inline guidance (more token-efficient, same coverage)
124- **Removed the standalone contact block table** — folded into the letter section order and prerequisites
125- **Consumer protection checklist** integrated into the letter's Step 8 with actionable details
126- **Added Troubleshooting** section per spec requirement (5 common issues with resolutions)
127- **Added litigation-defensibility guideline** — critical for breach notices
128- **Reduced from 149 lines to ~107 lines** while preserving all domain-accurate content
CaseMark