Checklist · Technology

Responding to a Data Breach: A Notification and Incident Response Checklist

45 C.F.R. § 164.410

Type: Checklist
Jurisdiction: National
Date: 2024-08-18
Topic: Technology

A data breach is a legal event with a clock attached, and the clock starts before anyone is certain what happened. This UpLaw checklist walks the response hour by hour and day by day: standing up the team under privilege, containing the intrusion without destroying the evidence, retaining forensics through counsel so the report has a chance of staying protected, and scoping precisely what data and whose data left the building. It then turns to the law: the encryption safe harbor and the risk-of-harm analysis that decide whether notice is owed at all, the fifty-state notification matrix and the sectoral overlays under HIPAA, GLBA, and state financial regulators, the GDPR's 72-hour supervisory-authority clock, and the SEC's Item 1.05 materiality determination for public companies. Worked through a ransomware incident at a fictional retailer, the checklist covers drafting the notice, notifying attorneys general and the credit bureaus, standing up the call center, running remediation and the litigation hold, and closing the file with an insurance claim and a defensible record. Every deadline in this document runs from a trigger, and the single most expensive mistake is misreading which trigger started it.

Responding to a Data Breach: A Notification and Incident Response Checklist

Technology > Privacy | Published 18 August 2024 - Updated 13 November 2025 | UpLaw - uplaw.us

The first seventy-two hours of a breach set the terms of the next three years of litigation. What you decide about privilege, preservation, and scope before you know what happened will be read back to you by a plaintiffs' lawyer who has all the time in the world.

Keywords: data breach response, incident response plan, breach notification, encryption safe harbor, risk of harm, HIPAA Breach Notification Rule, GDPR article 33, SEC Item 1.05, FTC Safeguards Rule, forensic report privilege, litigation hold, credit monitoring, attorney general notice, ransomware, cyber insurance

There is a particular kind of Monday that begins with a phone call from an engineer who is trying very hard to sound calm. Files are encrypted. A ransom note is sitting on a file server. Nobody can say yet whether anything left the network, and nobody will be able to say for days.

That uncertainty is the defining feature of breach response, and it is why the legal work cannot wait for it to resolve. Notification clocks in most American statutes start on discovery of a breach, not on completion of the forensic investigation. The European clock under the General Data Protection Regulation runs 72 hours from awareness. The Securities and Exchange Commission wants an 8-K within four business days of a materiality determination you are expected to make "without unreasonable delay." Meanwhile, every command you type on a compromised server either preserves or destroys the evidence you will need to prove that your response was reasonable.

One framing point before the sequence begins, because it governs everything below. There is no single nationwide breach-notification rule in the United States. There is no general federal breach-notification statute for consumer data; instead there are fifty-plus state statutes that differ on what data they cover, what triggers notice, how long you have, what the letter must say, and whom else you must tell — layered over sectoral federal regimes (HIPAA, GLBA, SEC) that apply only to particular kinds of entities or data. Every deadline and threshold in this checklist is therefore a representative example, not a national standard. Anywhere this document names a number, treat it as a prompt to look up the current rule in each affected jurisdiction, not as an answer.

This checklist is the sequence. It is written for in-house counsel, outside counsel, and the executive who has just been told to "handle the legal side." It runs through a hypothetical: Copperfield Retail, a 400-store specialty chain with an e-commerce arm, hit at 6:14 a.m. on a Monday with ransomware that has encrypted point-of-sale back-office servers and, it will later emerge, exfiltrated a file share containing customer order records and an HR folder. Copperfield is a public company with EU customers, a small pharmacy business inside forty of its stores, and a co-branded credit card. Its facts are chosen to trip nearly every wire, and it will appear throughout.

Before an incident ever lands, the groundwork should already be in place. If it is not, start with Standing Up a Privacy Compliance Program: A Practical Checklist and the deeper treatment in Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork. For the doctrine behind everything below — the statutory architecture, the definitions, the case law on standing and damages — read the companion Data Breach Notification Law: A Comprehensive Guide.

Hour 0 — Activate the response plan and stand up the team under privilege

[ ] Open the incident response plan and follow it; note the time of discovery in writing, because that timestamp is the trigger for nearly every clock that follows.
[ ] Have counsel — in-house or outside — formally direct the investigation. The direction should be documented in a short memo stating that the investigation is being conducted at counsel's direction in anticipation of litigation and to advise on legal obligations.
[ ] Convene the core team: legal, IT/security, communications, HR, and a business owner. Keep it small. Every added participant is an added deposition.
[ ] Designate a single incident commander and a single legal lead; nobody else speaks for the company.
[ ] Open a dedicated, access-restricted channel and document repository for the response. Label materials appropriately: Privileged & Confidential — Attorney Work Product — Prepared at the Direction of Counsel.
[ ] Instruct the team, in writing, to avoid speculation in writing. No "we should have patched that in March" in Slack.
[ ] Notify the cyber insurer immediately, or at least within the policy's notice window. Most policies require use of panel counsel and panel forensics, and using an off-panel vendor without consent can forfeit coverage.
[ ] Identify whether the incident implicates trade secrets or source code as well as personal data — a different and often larger problem.

Why it matters, and the traps. Privilege is not a label; it is a set of facts about who retained whom, why, and what the resulting work was used for. Courts have grown skeptical of reflexive privilege claims over incident-response work, and the leading cautionary tale is the In re Capital One Consumer Data Security Breach Litigation decision (E.D. Va. 2020), where the court ordered production of the forensic report because the company's pre-existing vendor relationship, the fact that the work was substantially the same as the vendor had always performed, and the report's distribution to business teams and regulators showed it would have been created in essentially the same form regardless of litigation. Wengui v. Clark Hill (D.D.C. 2021) reached the same result on similar reasoning. On the other side, In re Target Corp. Customer Data Security Breach Litigation (D. Minn. 2015) protected a genuinely separate, counsel-directed track of investigation that existed alongside the ordinary business remediation work.

The lesson is structural, not cosmetic. Two tracks: a business-remediation track that restores operations and generates the documents the business needs, and a counsel-directed track that develops the legal analysis. Do not let the second track's output become the company's operational bible, and do not send the privileged report to the board's audit committee, the credit card brands, and the state AGs and then claim it was for litigation. Also: the substantive right you are invoking is ordinary work product under Fed. R. Civ. P. 26(b)(3), which is qualified — it yields to substantial need for fact work product — and attorney-client privilege, which protects communications made to obtain legal advice. Build both records. For the mechanics of asserting and logging protection later, see Building a Privilege Log: A Practical Checklist.

Copperfield, 7:05 a.m. The GC sends a one-paragraph engagement memo to outside privacy counsel, who by 8:00 a.m. has signed a statement of work with a forensic firm — a firm Copperfield has never used for routine security work — under which the firm reports to counsel, invoices counsel, and delivers its findings to counsel.

Hour 0-24 — Contain and preserve: stop the bleeding without destroying the evidence

[ ] Contain: isolate affected systems from the network rather than powering them down where feasible, since a shutdown destroys volatile memory that may hold the encryption keys, the attacker's tooling, and the exfiltration evidence.
[ ] Capture forensic images and memory dumps of affected hosts before rebuilding or reimaging them.
[ ] Preserve logs immediately. Firewall, VPN, EDR, cloud audit, DNS, netflow, and email logs typically roll off on 7-, 30-, or 90-day cycles. Suspend rotation and export.
[ ] Rotate credentials and revoke sessions and tokens for privileged accounts; assume the attacker has domain credentials until forensics says otherwise.
[ ] Do not "test" the attacker's leak site from a corporate IP or engage the threat actor without counsel's involvement.
[ ] Issue a preservation directive to IT and to the response team. Do not let anyone delete, wipe, or reimage without a documented image first.
[ ] If a ransom payment is even conceivable, involve counsel on sanctions exposure. OFAC has warned that facilitating a payment to a sanctioned actor may violate the International Emergency Economic Powers Act, and that liability is strict.
[ ] Consider law-enforcement contact (FBI field office / IC3, Secret Service). Notice to law enforcement can, under many state statutes, delay consumer notification if law enforcement determines notice would impede an investigation — but only if that determination is documented.

Why it matters, and the traps. The instinct of a good sysadmin under attack is to rebuild fast. The instinct of a good litigator is to freeze everything. Both are right, and the reconciliation is: image, then rebuild. A company that cannot say what the attacker took because it wiped the servers will be treated, by regulators and by plaintiffs, as if the attacker took everything.

The preservation duty is also a legal one. Once litigation is reasonably foreseeable — and a large breach makes it foreseeable roughly instantly — the common-law duty to preserve attaches, and Fed. R. Civ. P. 37(e) supplies the sanctions for losing electronically stored information that should have been kept. Get the hold out early; the mechanics are in Issuing a Litigation Hold and Preserving ESI: A Practical Checklist.

Finally, remember that "personal data" is not the only asset at risk. If the intruder touched engineering repositories, pricing models, or supplier terms, you have a trade-secret incident running in parallel, with its own preservation and reasonable-measures problems. Run it deliberately: When a Breach Hits Your Crown Jewels: A Trade Secret Incident-Response Checklist and Protecting Trade Secrets During a Data Breach: Building IP Into Incident Response explain why the notification you send can itself undercut a later claim that the information was the subject of reasonable secrecy measures.

Day 1-3 — Engage forensics through counsel; preserve privilege and work product

[ ] Retain the forensic firm through counsel, on counsel's paper, with counsel as the client, paid through counsel's invoices where the policy allows.
[ ] Scope the engagement to the legal questions: what data was accessed or acquired, by whom, when, and whether it was rendered unusable.
[ ] Keep the deliverable narrow. Ask for the facts counsel needs; do not commission a general security assessment with recommendations that will read at deposition as an admission of every gap it lists.
[ ] Maintain the two-track separation: a business/IT remediation workstream with its own documents, and the privileged legal workstream.
[ ] Control distribution of the forensic report. Every additional recipient is an argument for waiver.
[ ] Log the response work as you go so that the privilege log later is a record, not a reconstruction.
[ ] Prepare for the possibility that the report is produced anyway. Write it as though a jury will read it.

Why it matters, and the traps. The three-part failure pattern in the privilege cases is: (1) the forensic firm was already on retainer for routine work; (2) the statement of work is unchanged from the pre-breach version; and (3) the report was circulated to business teams for remediation. Break all three. Engage a firm that does not do your routine security work (or, if you must use the incumbent, execute a genuinely new, counsel-directed SOW with a distinct scope), and pay for the incident work outside the ordinary IT budget.

Copperfield, Day 2. Forensics reports that the intruder was resident for nineteen days, moved laterally using a compromised vendor VPN credential, and staged a 41 GB archive on an external host. The archive contents are not yet enumerated. Counsel resists the temptation to tell the board "no data was taken" — an assertion Copperfield cannot yet support and will not be able to walk back.

Day 1-7 — Scope the incident: what data, whose data, which jurisdictions

[ ] Enumerate the data elements actually implicated: names, addresses, Social Security numbers, driver's license or state ID numbers, financial account numbers with access codes, payment card data, medical or health-insurance information, biometric identifiers, online credentials, precise geolocation.
[ ] Pull the data map and the records-retention schedule. If you have one, this takes days; if you do not, it takes weeks.
[ ] De-duplicate and normalize the affected-individual list into a single master file with a state/country field. That field drives everything downstream.
[ ] Segment by population: consumers, employees, patients, minors, EU/UK data subjects, and residents of states with special rules.
[ ] Identify whose data you are holding as a processor / service provider for someone else, because your obligation there is contractual notice to the controller, not consumer notice.
[ ] Confirm whether payment card data is involved (PCI DSS forensic-investigator obligations and card-brand notice run on contract, not statute).
[ ] Confirm whether protected health information is involved anywhere in the enterprise.

Why it matters, and the traps. Notification obligations are a function of data elements and residency, not of how bad the incident felt. The near-universal American definition of "personal information" is a first name or initial plus last name in combination with one of an enumerated set of elements — see Cal. Civ. Code § 1798.82(h) and N.Y. Gen. Bus. Law § 899-aa(1)(b) as the two canonical formulations — with modern statutes adding biometric data, medical information, health insurance information, and username/password pairs. The residency of the individual, not the location of the company or the server, determines which state's statute applies.

Copperfield's pharmacy business means some of the affected records are protected health information, which pulls in the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, for that population — a different clock, a different content standard, and notice to the Department of Health and Human Services. If a vendor holds the ePHI, the business-associate notification chain in 45 C.F.R. § 164.410 governs; see HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI.

Apply the thresholds: encryption safe harbor and the risk-of-harm analysis

[ ] Encryption safe harbor. Determine whether the affected data was encrypted and whether the encryption key was also compromised. Most state statutes define the protected category as unencrypted personal information, so properly encrypted data with an uncompromised key generally means no consumer notice is required.
[ ] Document the encryption standard, the key management, and the evidence that keys were not acquired. A conclusory "it was encrypted" will not survive an AG inquiry.
[ ] Note the HIPAA analogue: PHI rendered "unusable, unreadable, or indecipherable" per HHS guidance (encryption to NIST standards, or destruction) is not "unsecured PHI," and the breach rule is not triggered.
[ ] Note the GDPR analogue: art. 34(3)(a) excuses individual notification where the data was rendered unintelligible by encryption — but it does not excuse the art. 33 notice to the supervisory authority.
[ ] Risk-of-harm analysis. Where the statute permits it, assess whether the breach is reasonably likely to result in harm (or, in HIPAA's framing, whether there is a low probability that the PHI has been compromised).
[ ] Run the HIPAA four-factor assessment under 45 C.F.R. § 164.402: (1) the nature and extent of the PHI, including identifiers and likelihood of re-identification; (2) the unauthorized person who used or received it; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which risk has been mitigated.
[ ] Write the determination down, with the facts supporting it, and retain it. Florida, for example, requires a written no-harm determination to be retained for five years and produced to the Department of Legal Affairs on request. Fla. Stat. § 501.171(4)(c).
[ ] Remember that HIPAA presumes a breach: an impermissible use or disclosure of unsecured PHI is a breach unless the covered entity demonstrates low probability of compromise. The burden runs against you.

Why it matters, and the traps. These two doctrines are where most of the real money is decided, and both are frequently misapplied. The encryption safe harbor is a data-at-rest concept; if the attacker compromised an application server and read data through the application — that is, in decrypted form — the fact that the disk was encrypted is legally irrelevant. Likewise, ransomware that encrypts your data does not shield you: your own encryption of the data by the attacker is not the statutory safe harbor, and HHS guidance treats a ransomware encryption event as a presumptive breach of unsecured PHI.

The risk-of-harm exception is real but narrow, and it is not available in every state. A handful of states require notice without any harm-based off-ramp. The safe operating rule: run the analysis state by state, write it down, and understand that a no-notice decision is a decision you will defend later, in public, with hindsight bias running against you.

Build the notification matrix: 50 states, sectoral regimes, and contractual duties

[ ] Build a matrix with a row per jurisdiction and columns for: notice required?, deadline, content requirements, regulator/AG notice, threshold for regulator notice, consumer reporting agency notice, credit monitoring mandate, substitute-notice thresholds.
[ ] Populate it from the master affected-individual list. All fifty states, the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands have notification statutes.
[ ] Identify the shortest applicable deadline and drive the whole program to it. Several states impose a hard outer limit of 30 days (Colorado, Florida, Maine, and Washington among them); others say "without unreasonable delay" with a 45- or 60-day backstop (Texas, for instance, sets 60 days under Tex. Bus. & Com. Code § 521.053).
[ ] Layer the sectoral regimes:
- [ ] HIPAA: individual notice without unreasonable delay and no later than 60 days from discovery (45 C.F.R. § 164.404); HHS notice contemporaneously if 500 or more individuals are affected, otherwise on an annual log within 60 days after year-end (§ 164.408); prominent media notice in the state or jurisdiction if 500+ residents of that state are affected (§ 164.406).
- [ ] GLBA / FTC Safeguards Rule, 16 C.F.R. Part 314: financial institutions must maintain the security program and, since the 2023 amendment, report a "notification event" involving the unencrypted information of 500 or more consumers to the FTC as soon as possible and no later than 30 days after discovery.
- [ ] SEC-regulated entities: amended Regulation S-P adds customer notification obligations for broker-dealers, investment advisers, and investment companies.
- [ ] NYDFS Part 500 (23 NYCRR § 500.17): covered financial entities must notify the Superintendent within 72 hours of determining a cybersecurity event occurred, with an additional prompt notice if a ransom is paid.
- [ ] Critical infrastructure: track the reporting regime under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), 6 U.S.C. § 681b, as CISA's implementing rules take effect.
[ ] Layer the contractual duties: customer master agreements, DPAs, BAAs, card-brand rules, and vendor agreements routinely impose 24- to 72-hour notice obligations that are shorter than any statute.
[ ] Check for a private right of action — most state breach statutes do not create one, but the exceptions are where the class-action exposure concentrates. California's CCPA, Cal. Civ. Code § 1798.150, allows statutory damages of $100 to $750 per consumer per incident for breaches of nonencrypted, nonredacted personal information caused by a failure to maintain reasonable security. Illinois's Biometric Information Privacy Act, 740 ILCS 14, is its own universe if biometric identifiers are in the affected set; see Biometric Privacy Law and the AI Systems That Read Faces and Voices.
[ ] If any affected data came through a mobile app, check the app-specific overlays — SDK and ad-tech data flows routinely put more in the affected set than the engineering team expects. See Mobile App Privacy Law: A Compliance Map for Founders and Counsel.

Why it matters, and the traps. The matrix is the deliverable that turns fifty statutes into one project plan. Two traps recur. First, companies notify on the longest deadline and blow the shortest, then explain to a Colorado regulator why Colorado residents heard on day 52. Second, they forget that contracts move faster than statutes: the enterprise customer whose DPA required 48-hour notice will not be consoled by the fact that Ohio allowed 45 days.

Copperfield, Day 6. The master file resolves to 612,000 individuals across 47 states, 8,400 EU residents, 3,100 employees (including HR files with SSNs), and 4,900 pharmacy customers whose records are PHI. The 30-day states set the pace; the pharmacy population runs on the HIPAA track; and a co-branded card partner's agreement requires notice within 24 hours of "any suspected compromise," which — Copperfield's counsel realizes with dismay — was arguably triggered on Monday morning.

The GDPR 72-hour supervisory-authority clock

[ ] Determine whether the incident is a "personal data breach" under GDPR art. 4(12) — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Availability breaches (ransomware encrypting data you cannot restore) count.
[ ] Determine whether you are a controller or a processor. A processor must notify the controller "without undue delay" (art. 33(2)); the controller notifies the supervisory authority.
[ ] If you are the controller and the breach is likely to result in a risk to the rights and freedoms of natural persons, notify the competent supervisory authority within 72 hours of becoming aware (art. 33(1)). If you miss it, notify anyway and explain the delay — art. 33(1) expressly contemplates a reasoned explanation.
[ ] Use phased notification (art. 33(4)) where information is unavailable: file within 72 hours with what you have, and supplement.
[ ] Identify your lead supervisory authority under the one-stop-shop (art. 56) if you have a main establishment in the EU; if you do not, you may face notifications in every affected member state.
[ ] Assess art. 34: where the breach is likely to result in a high risk to individuals, communicate to the data subjects without undue delay, unless the art. 34(3) exceptions apply (encryption, subsequent measures eliminating the high risk, or disproportionate effort justifying a public communication).
[ ] Record every breach in the internal breach register required by art. 33(5), including those you decide not to report.
[ ] Run the parallel UK GDPR analysis (ICO) and any Swiss/other analogues.

Why it matters, and the traps. Seventy-two hours is not seventy-two hours from certainty. "Awareness" arrives when the controller has a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised — not when the forensic report is signed. Companies routinely burn the clock waiting to "get the facts" and then must explain the delay to a regulator who has read the same guidance you have.

The other trap is anchoring the whole EU analysis on data-subject notification. Art. 33 (authority) and art. 34 (individuals) are separate tests with separate thresholds: risk for the regulator, high risk for the individuals. Encryption may excuse the second and never excuses the first. For related cross-border mechanics, see Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments, and for the downstream individual-rights traffic a breach always generates, Responding to a Data Subject Access Request: A Practical Checklist.

Public company? The SEC Item 1.05 materiality determination and the 8-K

[ ] Convene the disclosure committee and route the incident into the company's disclosure controls.
[ ] Make a materiality determination without unreasonable delay after discovery. The determination — not the incident — starts the filing clock.
[ ] If the incident is material, file a Form 8-K under Item 1.05 within four business days of the materiality determination, describing the material aspects of the nature, scope, and timing of the incident and its material impact or reasonably likely material impact on the registrant, including financial condition and results of operations.
[ ] You are not required to disclose specific or technical information about incident response, systems, or vulnerabilities in a way that would impede response or remediation.
[ ] Amend the 8-K when material information that was unavailable becomes available.
[ ] Consider the narrow national-security/public-safety delay: the Attorney General may determine that immediate disclosure poses a substantial risk to national security or public safety and notify the Commission in writing.
[ ] If the incident is not material, consider voluntary disclosure under Item 8.01 — but be aware the SEC has signaled that Item 1.05 should be reserved for material incidents, and that using it for immaterial ones muddies the signal.
[ ] Update the annual Item 106 disclosures under 17 C.F.R. § 229.106 (risk management, strategy, and governance, including board oversight and management's role) in the next Form 10-K.
[ ] Consider aggregation: a series of related immaterial incidents may together be material.
[ ] Impose a trading blackout and check Regulation FD before anyone briefs a large shareholder.

Why it matters, and the traps. Materiality here is the ordinary securities-law standard — whether a reasonable investor would consider the information important — and it is not measured solely in dollars of remediation cost. Reputational harm, customer churn, litigation exposure, and operational disruption all count. Copperfield's stores can still sell, but its e-commerce is down and its pharmacy business is exposed; the disclosure committee concludes on Day 5 that the incident is material and files within four business days of that conclusion, taking care that the 8-K, the customer FAQ, and the AG notices tell the same story. Inconsistency between the securities disclosure and the consumer notice is a gift to a plaintiff's lawyer and, increasingly, to the SEC's Enforcement Division.

Draft the notice: required content, tone, and the offer of credit monitoring

[ ] Draft one master notice and then customize by jurisdiction rather than drafting fifty from scratch.
[ ] Include, at a minimum: what happened; what information was involved; what you are doing; what the recipient can do; and where to get more information.
[ ] Follow California's prescribed format where CA residents are notified — Cal. Civ. Code § 1798.82(d)(1) requires the notice be titled "Notice of Data Breach" and use the headings "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information."
[ ] Watch the state-specific content prohibitions: Massachusetts forbids describing the nature of the breach or the number of residents affected in the consumer notice (Mass. Gen. Laws ch. 93H, § 3(b)), and requires telling the consumer of the right to obtain a police report and to request a security freeze.
[ ] Include mandated remedies where a state requires them. A handful of states mandate that credit monitoring or identity-theft mitigation services be offered at no cost, typically when Social Security numbers are involved, and typically for a fixed term (Massachusetts and Connecticut are the commonly cited examples; California's § 1798.82(d)(2)(G) directs that such services be offered for not less than 12 months where SSNs or driver's license numbers are involved and the notifying entity was the source of the breach). The list of mandating states, the triggering data elements, and the required duration all change; confirm each state's current rule on the matrix rather than relying on any summary, including this one.
[ ] Include the toll-free numbers and addresses of the three nationwide consumer reporting agencies and the FTC where required.
[ ] Use substitute notice only if you meet the statutory predicates (cost above a threshold, class above a size, or lack of contact information) — typically email plus conspicuous website posting plus statewide media.
[ ] Have the notice reviewed by counsel, by communications, and by the person who will staff the call center.
[ ] Send by first-class mail unless the recipient has consented to electronic notice under the E-SIGN Act, 15 U.S.C. § 7001; do not simply email everyone because you have their address.

Why it matters, and the traps. The notice is a legal document that reads like a consumer letter, and the tension between those two things is where drafts go wrong. Overstate ("we have no evidence of misuse") and you invite a misrepresentation claim if misuse surfaces. Understate ("an incident affecting certain systems") and you get an AG letter asking why you buried it. Say "your data was stolen" when you cannot prove acquisition and you have given the plaintiffs' bar an admission.

A related trap is the timing/content deadlock: counsel wants to wait for forensic certainty; the statute does not. Resolve it by writing to what you know, describing the investigation as ongoing, and reserving the right to supplement. And beware inconsistency across channels — the 8-K, the AG letter, the consumer notice, the press statement, and the call-center script must all be traceable to a single approved fact set. The privacy-policy discipline of saying only what is true and complete applies here too; see Drafting a Privacy Policy: A Practical Checklist.

Notify regulators, attorneys general, and the credit reporting agencies

[ ] File state attorney general notices where thresholds are met. The thresholds and forms differ: California requires submission of a sample notice to the AG when more than 500 California residents are notified; Texas requires AG notice within 30 days when 250 or more Texas residents are affected; New York requires notice to the Attorney General, the Department of State, and the Division of State Police (N.Y. Gen. Bus. Law § 899-aa(8)).
[ ] Use each state's online portal or prescribed form — several states will not accept a free-form letter.
[ ] Notify the nationwide consumer reporting agencies (Equifax, Experian, TransUnion) where the statute requires it. Thresholds vary: New York, for example, requires CRA notice when more than 5,000 residents are notified at one time, and several other states set a 1,000-resident trigger. Do not assume a common number — confirm the current threshold state by state on your matrix.
[ ] File the HHS breach report through the OCR portal (immediately for 500+, on the annual log otherwise), and remember that 500+ breaches are published on OCR's public portal.
[ ] File with the FTC under the Safeguards Rule if you are a covered financial institution and the event reaches 500 consumers.
[ ] Notify sector regulators: the federal banking agencies, whose computer-security incident notification rule requires a banking organization to notify its primary federal regulator within 36 hours of determining that a notification incident has occurred (12 C.F.R. pt. 53 (OCC), pt. 225 subpt. N (Federal Reserve), and pt. 304 subpt. C (FDIC)); state insurance regulators under the NAIC Insurance Data Security Model Law in the states that have adopted it; and state financial regulators.
[ ] Notify EU/UK supervisory authorities on the art. 33 track.
[ ] Keep a filing register: jurisdiction, date filed, method, confirmation number, and the exact version of the notice sent.

Why it matters, and the traps. Regulator notice is where sloppy record-keeping becomes visible. AGs compare your notice to your peers', to your privacy policy, and to your 8-K. Multistate AG groups now routinely coordinate, and a single filing can seed a multistate investigation that outlives the incident by years. File on time, file consistently, and keep the register.

Notify customers and downstream partners under contract

[ ] Pull every agreement with a security-incident notice clause: enterprise customer MSAs, DPAs, BAAs, card-brand agreements, lender covenants, and channel-partner agreements.
[ ] Diary the contractual clocks separately from the statutory ones — they are usually shorter.
[ ] If you are a service provider/processor, notify your controllers/customers with the facts they need to run their own notification analysis; do not make their legal decisions for them, and do not notify their individuals without direction.
[ ] Coordinate messaging with major customers before they hear it from a journalist.
[ ] Track indemnity, limitation-of-liability, and security-breach carve-out provisions; many contracts exclude data-breach liability from the general cap.
[ ] Preserve your own claims against the vendor whose credential or software was the entry point.

Why it matters, and the traps. The B2B layer is the most-missed layer. It is also where the company's largest single-dollar exposure often lives, because negotiated contracts frequently carve data breaches out of the liability cap and add an indemnity for notification costs. If a vendor was the vector — as it was for Copperfield, whose intruder used a facilities-management vendor's VPN credential — read that vendor's contract on Day 2, not Day 60, and send a preservation and reservation-of-rights letter.

Stand up the call center, the FAQ, and the communications plan

[ ] Contract a call center sized to the population; a 600,000-person notification generates a call volume that will destroy an in-house help desk.
[ ] Write a script and an FAQ approved by counsel; forbid improvisation.
[ ] Stand up a dedicated incident webpage that goes live the day the letters land, not before.
[ ] Prepare holding statements for media, employees, investors, and enterprise customers; align them all to the approved fact set.
[ ] Prepare the enrollment mechanics for the credit-monitoring offer (activation codes, deadlines, vendor SLAs).
[ ] Brief the board, and document the briefing — board oversight of cybersecurity is now an express disclosure item under Item 106.
[ ] Monitor for phishing that impersonates your own breach notice. It happens every time.

Why it matters, and the traps. The communications plan is a legal deliverable. Every word your call center says is a company statement; every FAQ answer is a potential exhibit. The single most common unforced error is a spokesperson volunteering that "no sensitive information was accessed" before forensics can support it. The second is letting the incident page go live before the letters arrive, so customers learn from the internet that their data was stolen.

Remediation, corrective action, and the litigation hold

[ ] Close the vector: patch, rotate, remove the compromised access path, and verify.
[ ] Implement the controls the incident exposed — MFA everywhere, network segmentation, privileged-access management, log retention, EDR coverage, vendor access review.
[ ] Update the incident-response plan and the security program documentation; the FTC Safeguards Rule and most state reasonable-security standards require a written program and periodic reassessment.
[ ] Issue and monitor the litigation hold, extending to the response materials themselves, and re-issue it as new custodians surface.
[ ] Anticipate the class actions (they are typically filed within days of notice), the AG inquiries, and the regulator document demands.
[ ] Do not remediate in a way that destroys evidence of the original configuration — preserve the "before" state.
[ ] Take corrective action on people and processes carefully, in consultation with employment counsel; terminating the administrator who missed the patch on Day 10 looks like an admission on Day 400.

Why it matters, and the traps. Remediation is evidence. In every enforcement resolution, the regulator's account of what the company did after the breach is nearly as prominent as its account of what went wrong. A company that fixed the root cause, documented it, and improved its program is a company that settles. A company that patched quietly and changed nothing else is a company that pays a fine and accepts a twenty-year consent order.

Post-incident: the record, the insurance claim, and the lessons learned

[ ] Assemble the incident file: the discovery timestamp, the containment log, the forensic findings, the scoping methodology, the notification determinations (including any no-notice determinations and their support), every notice sent, every regulator filing, and the remediation record.
[ ] Retain the no-harm determinations for the statutory period (five years in Florida; check your states).
[ ] Submit the insurance claim with the documentation the policy requires; track forensic costs, notification costs, call-center costs, credit monitoring, legal fees, PR, and business interruption. Watch sublimits and the "betterment" exclusion that may bar coverage for security upgrades.
[ ] Conduct a lessons-learned review — but understand it is discoverable unless conducted under counsel's direction for legal advice, and even then may not be protected. Decide deliberately how candid to be and in what form.
[ ] Update the data map, retention schedule, and vendor-management program. The best remediation is holding less data; see Data Minimization and Storage Limitation: Curbing the Over-Retention of Personal Data.
[ ] Tabletop the next one, using this incident as the scenario.
[ ] Feed the lessons back into governance — including for AI systems, which introduce new data flows and new failure modes; see Deploying an AI System: An AI Governance and Risk Checklist and AI Governance and Compliance: A Comprehensive Guide.

Common mistakes to avoid

Starting the clock from the wrong event. Most American clocks run from discovery; GDPR runs from awareness; the SEC's runs from the materiality determination, which itself must be made without unreasonable delay. Confusing them is the most expensive calendaring error in privacy law.
Retaining forensics on the IT budget. The report you cannot protect is the report that becomes Exhibit A.
Powering down the servers. Volatile memory dies with the machine, and so does your ability to prove what did not leave.
Treating encryption as a universal shield. It is a data-at-rest safe harbor, not an incident-wide immunity, and it never excuses the GDPR art. 33 filing.
Notifying on the longest deadline. Drive to the shortest applicable clock, statutory or contractual.
Forgetting contractual notice. DPAs and card-brand rules routinely demand notice in 24 to 72 hours.
Saying more than you know. "No evidence of misuse" is a sentence that has cost companies eight figures.
Inconsistent narratives. The 8-K, the consumer letter, the AG filing, and the call-center script must reconcile line by line.
Missing the trade-secret and IP dimension of an incident that everyone is treating as a privacy problem.
Skipping the written no-harm determination when you decide not to notify. An undocumented judgment call is, to a regulator, indistinguishable from a cover-up.

The consolidated incident-response checklist

[ ] Hour 0: log the discovery time; counsel directs the investigation; convene a small team; label materials; notify the insurer; open the privileged channel.
[ ] Hour 0–24: contain without destroying; image before rebuilding; preserve logs; rotate credentials; issue the preservation directive; consider law enforcement; screen any ransom payment for OFAC exposure.
[ ] Day 1–3: retain forensics through counsel on a new, narrow SOW; maintain two tracks; control distribution.
[ ] Day 1–7: scope data elements, individuals, and jurisdictions; segment consumers, employees, patients, EU subjects, and processor-held data.
[ ] Thresholds: apply the encryption safe harbor with evidence; run the risk-of-harm / four-factor analysis; write the determination down.
[ ] Matrix: fifty states plus territories; layer HIPAA (60 days; 500-individual triggers), the FTC Safeguards Rule (30 days; 500 consumers), NYDFS (72 hours), CIRCIA, and every contract.
[ ] GDPR: 72 hours to the supervisory authority under art. 33; art. 34 to individuals on high risk; register every breach.
[ ] SEC: materiality determination without unreasonable delay; Item 1.05 8-K within four business days; Item 106 in the 10-K.
[ ] Notice: master draft plus jurisdictional overlays; California's mandated headings; Massachusetts's content prohibition; mandated credit monitoring where required.
[ ] Regulators: AG filings and portals; CRAs above threshold; HHS OCR; FTC; sector regulators; keep a filing register.
[ ] Contracts: notify controllers, enterprise customers, and card brands; preserve claims against the vendor vector.
[ ] Communications: call center, FAQ, incident page, board briefing, holding statements — all from one fact set.
[ ] Remediation: close the vector; upgrade the program; litigation hold; preserve the "before" state.
[ ] Close: assemble the record; file the insurance claim; retain determinations; tabletop the next incident.

Primary Authority

State breach-notification statutes. All fifty states, the District of Columbia, and the U.S. territories have one, and they are not uniform; there is no general federal consumer breach-notification statute that preempts them. The statutes below are cited as representative formulations of the recurring concepts — they are not a national rule and not a substitute for checking each affected jurisdiction. Cal. Civ. Code § 1798.82 (definition of personal information; unencrypted-data trigger; prescribed notice format at § 1798.82(d)(1); AG submission above 500 California residents); Cal. Civ. Code § 1798.29 (state agencies); Cal. Civ. Code § 1798.150 (CCPA private right of action, $100–$750 per consumer per incident); N.Y. Gen. Bus. Law § 899-aa (SHIELD Act notification; AG, Department of State, and State Police notice; consumer reporting agency notice above 5,000 residents) and § 899-bb (reasonable safeguards); Mass. Gen. Laws ch. 93H (notice; content prohibitions; credit monitoring) and 201 C.M.R. 17.00 (written information security program); Fla. Stat. § 501.171 (30-day notice; written no-harm determination retained five years); Tex. Bus. & Com. Code § 521.053 (60-day notice; AG notice at 250 residents); 740 ILCS 14 (Illinois Biometric Information Privacy Act).

HIPAA: Breach Notification Rule, 45 C.F.R. §§ 164.400–414 — § 164.402 (definition of breach; four-factor risk assessment; presumption of breach), § 164.404 (individual notice within 60 days of discovery), § 164.406 (media notice for 500+ residents of a state), § 164.408 (HHS notice; immediate for 500+, annual log otherwise), § 164.410 (business associate notice to covered entity).

GDPR: Regulation (EU) 2016/679, art. 4(12) (personal data breach), art. 33 (notification to the supervisory authority within 72 hours; processor notice to controller; phased notification; internal breach register), art. 34 (communication to the data subject on high risk; encryption and disproportionate-effort exceptions), art. 56 (lead supervisory authority).

Securities regulation: Form 8-K Item 1.05 (material cybersecurity incidents; four business days after the materiality determination); Regulation S-K Item 106, 17 C.F.R. § 229.106 (risk management, strategy, and governance disclosure); Regulation S-P (customer notification for broker-dealers, investment advisers, and investment companies); Regulation FD.

Financial and sectoral: FTC Safeguards Rule, 16 C.F.R. Part 314 (information security program; § 314.4(j) notification of a notification event affecting 500+ consumers within 30 days); FTC Health Breach Notification Rule, 16 C.F.R. Part 318; 23 N.Y.C.R.R. Part 500 (NYDFS cybersecurity regulation; § 500.17 notice to the Superintendent within 72 hours); Cyber Incident Reporting for Critical Infrastructure Act of 2022, 6 U.S.C. § 681b; Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809.

Privilege and preservation: Fed. R. Civ. P. 26(b)(3) (work-product protection; qualified as to fact work product); Fed. R. Civ. P. 37(e) (failure to preserve ESI); Upjohn Co. v. United States, 449 U.S. 383 (1981) (attorney-client privilege in the corporation); Hickman v. Taylor, 329 U.S. 495 (1947) (work-product doctrine). On forensic reports specifically, compare In re Capital One Consumer Data Security Breach Litigation (E.D. Va. 2020) and Wengui v. Clark Hill, PLC (D.D.C. 2021), which ordered production, with In re Target Corp. Customer Data Security Breach Litigation (D. Minn. 2015) and In re Experian Data Breach Litigation (C.D. Cal. 2017), which protected genuinely counsel-directed, two-track investigations.

Standing and damages: TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (concrete-injury requirement in Article III standing, central to data-breach class actions); Clapper v. Amnesty International USA, 568 U.S. 398 (2013) (risk of future harm must be certainly impending).

Sanctions: International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1708, and OFAC's advisory on the sanctions risks of facilitating ransomware payments.

Secondary sources: NIST Special Publication 800-61 (Computer Security Incident Handling Guide); NIST Cybersecurity Framework 2.0; HHS OCR guidance on ransomware and HIPAA; the FTC's Data Breach Response: A Guide for Business; state attorney general breach-reporting portals and their published annual breach reports.

Related UpLaw Resources

Related Guides & Articles

Data Breach Notification Law: A Comprehensive Guide — the doctrine behind this checklist: triggers, definitions, the fifty-state architecture, and the litigation landscape.
Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork
HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI
Data Minimization and Storage Limitation: Curbing the Over-Retention of Personal Data
Mobile App Privacy Law: A Compliance Map for Founders and Counsel
Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments
Protecting Trade Secrets During a Data Breach: Building IP Into Incident Response
Biometric Privacy Law and the AI Systems That Read Faces and Voices
AI Governance and Compliance: A Comprehensive Guide

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Breach-notification law is state-specific and changes frequently; deadlines, thresholds, and content requirements vary by jurisdiction and by sector. Verify current requirements in every affected jurisdiction and consult qualified counsel before acting.