# Breach Notification Template — California (Civ. Code §1798.82)

Template id: `breach-notice-ca-ag-us.v1` owner: Lilith-Privacy lead + US
counsel deadline: notify affected California residents **in the most
expedient time possible and without unreasonable delay**; if more than 500
California residents are notified, submit a single sample copy of the notice
to the California Attorney General (electronic submission)

Trigger scope: unauthorized acquisition of unencrypted personal information
(or encrypted where the key was also compromised) — the legal owner makes the
encryption-safe-harbor call, never engineering alone.

## Resident notice — required format (§1798.82(d))

Plain language, titled "Notice of Data Breach", organized under these exact
headings:

1. **What Happened** — date(s) of breach, date discovered, general
   description.
2. **What Information Was Involved** — the categories of personal information
   (name plus SSN / driver's license / financial account, or
   username-and-password credentials, etc., as scoped).
   - V3 data-class mapping: account credentials (username/e-mail + password
     or security question) trigger §1798.82(d)(4) — that notice may direct
     the user to change passwords promptly; payment data follows the
     financial-account branch.
3. **What We Are Doing** — containment, the forced credential rotation /
   family revocation already executed per the security runbook, and any
   services offered (if SSNs/driver's licenses involved: ≥12 months identity
   theft prevention/mitigation services, §1798.82(d)(2)(G)).
4. **What You Can Do** — concrete steps; credit-reporting-agency contact info
   where applicable.
5. **For More Information** — toll-free number / e-mail / postal address.

Delivery: written or electronic notice consistent with E-SIGN; substitute
notice (site posting + statewide media + e-mail) only if counsel confirms the
statutory cost/volume thresholds.

## AG submission

- Single sample copy of the resident notice, without personal information,
  via the AG's online breach reporting form, when >500 CA residents notified.

## Internal routing

- Drafted by: Lilith-Privacy lead. Reviewed by: US counsel (mandatory).
- "Without unreasonable delay" is interpreted in days, not weeks; delay is
  permitted only for legitimate law-enforcement needs or to determine scope
  and restore integrity — document the reason for every day between
  confirmation and notice.
- Evidence: sent notice, recipient count, AG submission receipt, and
  timestamps in the incident evidence bucket, referenced from the Operator
  Console case.