Notice of Data Breach Template
California residents · Cal. Civ. Code §1798.82
Why this matters
Cal. Civ. Code §1798.82 requires any person or business that owns or licenses computerized data including personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The statute prescribes the notice’s title, the five mandatory headings, a 10-point minimum type size, a 30-day disclosure clock running from discovery or notification of the breach, a 15-day sample-copy rule for the Attorney General — running from the date affected consumers are notified — when more than 500 California residents are affected by a single breach, and a 12-month identity-theft prevention services offer when the notifying organization was the source of the breach and the breach exposed a Social Security number or a government-issued identification number (driver’s license, California identification card, tax identification, passport, or military identification number).
The California Attorney General publishes operational guidance and a sample-submission portal for the 15-day AG-notice rule.
How to use this template
- Print this page (Cmd/Ctrl + P) or copy the template text into your incident-response document.
- Replace bracketed placeholders such as
[ORGANIZATION NAME],[BREACH DATE], and[DATA CATEGORIES]with your verified facts. Do not guess — if a field is unknown, leave the placeholder so counsel can address it. - Send the draft to counsel for review before any affected resident, the Attorney General, the press, or any third party receives it.
- Retain the final notice, distribution lists, and AG-portal submission confirmations per your record-retention schedule.
Response-timeline reference card
30 days from discovery or notification
Notify affected California residents within 30 calendar days of discovery or notification of the breach — not from when the org is ready to send. Subject to the (a)(2)(B) carve-out for legitimate law-enforcement needs and the time reasonably necessary to determine breach scope and restore data-system integrity.
Cal. Civ. Code §1798.82(a)(2)
15 days from consumer notification — AG sample copy
If a single breach affects more than 500 California residents, electronically submit a sample copy of the notice to the California Attorney General within 15 calendar days of notifying affected consumers.
Cal. Civ. Code §1798.82(f)
12 months — identity-theft services
If the notifying organization was the source of the breach and the compromised data included a Social Security number or a government-issued identification number (driver’s license, California ID, passport, etc.), offer appropriate identity-theft prevention and mitigation services at no cost for not less than 12 months.
Cal. Civ. Code §1798.82(d)(2)(G) (cross-refs (h)(1)(A)–(B))
— Begin Notice Template —
Notice of Data Breach
[NOTICE DATE]
[RECIPIENT NAME][RECIPIENT ADDRESS]
Dear [RECIPIENT NAME],
We are writing to inform you of a recent incident involving certain personal information that [ORGANIZATION NAME] maintains. We take the protection of your information seriously and are providing this notice so you can take steps to help protect yourself.
What Happened?
On [DISCOVERY DATE], [ORGANIZATION NAME] discovered that [BRIEF DESCRIPTION OF THE INCIDENT, INCLUDING THE BREACH DATE OR DATE RANGE IF KNOWN]. We immediately began an investigation and engaged [FORENSIC / LEGAL / LAW-ENFORCEMENT RESOURCES ENGAGED] to determine the scope of the incident and the information potentially affected.
Law-enforcement-delay disclosure (§1798.82(d)(2)(D)) — required when this information is possible to determine at the time the notice is provided. Use exactly one of the two statements below: [OPTION A — NO DELAY: This notification was not delayed by a law enforcement investigation.] [OPTION B — DELAYED: This notification was delayed at the request of law enforcement until [DATE THE DELAY WAS LIFTED] because notification was determined to impede a criminal investigation.]
What Information Was Involved?
Based on our investigation, the personal information potentially involved included: [DATA CATEGORIES — e.g., name, mailing address, Social Security number, driver’s license number, California identification card number, financial account number, medical information, health insurance information, etc.]. The investigation has [NOT FOUND / FOUND] evidence that the information has been misused.
What We Are Doing,
In response to this incident, [ORGANIZATION NAME] has taken the following steps: [REMEDIATION STEPS — e.g., contained the incident, reset credentials, engaged a forensic firm, notified law enforcement, strengthened monitoring and access controls, etc.].
Conditional — include only if a single breach affects more than 500 California residents (§1798.82(f)) or if other regulator notifications are in fact required by counsel: We are also notifying [CALIFORNIA ATTORNEY GENERAL / OTHER REGULATORS AS DETERMINED BY COUNSEL] as required.
Conditional — include only if your organization was the source of the breach AND the breach exposed a Social Security number or a government-issued identification number (driver’s license, California ID, tax ID, passport, military ID): Because the affected information included [SSN / DRIVER’S LICENSE / CALIFORNIA ID / OTHER GOVERNMENT-ISSUED IDENTIFICATION NUMBER], we are offering you [NAME OF SERVICE] identity-theft prevention and mitigation services at no cost to you for 12 months. Enrollment instructions and your activation code are included with this letter.
What You Can Do,
We encourage you to take the following protective steps:
- Review account statements and credit-report activity for any unauthorized transactions.
- Place a fraud alert or security freeze with the three nationwide credit reporting agencies (Equifax, Experian, TransUnion).
- Request a free credit report at
[CREDIT-REPORTING-AGENCY URL]. - Report any suspected identity theft to local law enforcement, the California Attorney General, and the Federal Trade Commission at
[FTC IDENTITY-THEFT URL]. [ADDITIONAL RECOMMENDED STEPS, IF ANY]
Credit-bureau contact block (§1798.82(d)(2)(F)) — required when the breach exposed a Social Security number, driver’s license number, or California identification card number. Include the toll-free telephone numbers and addresses of the major credit reporting agencies. Verify the current numbers and addresses with each agency before sending:
- Equifax —
[EQUIFAX TOLL-FREE NUMBER],[EQUIFAX MAILING ADDRESS] - Experian —
[EXPERIAN TOLL-FREE NUMBER],[EXPERIAN MAILING ADDRESS] - TransUnion —
[TRANSUNION TOLL-FREE NUMBER],[TRANSUNION MAILING ADDRESS]
For More Information.
If you have questions, please contact [ORGANIZATION CONTACT NAME / TITLE] at [CONTACT PHONE], [CONTACT EMAIL], or [POSTAL ADDRESS]. A dedicated breach response line is available at [BREACH-RESPONSE HOTLINE], [HOURS OF OPERATION]. We sincerely apologize for any inconvenience or concern this incident may cause.
Sincerely,
[SIGNATURE][SIGNER NAME][SIGNER TITLE][ORGANIZATION NAME]
— End Notice Template —
Out of scope for this template
This page covers the §1798.82 consumer-notice content only. The following adjacent obligations are not covered here and require separate analysis with counsel:
- Cal. Civ. Code §1798.81.5 — reasonable security procedures and practices for personal information.
- Cal. Civ. Code §1798.84 — civil remedies and statutory damages for violations.
- Other parts of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the private right of action under Cal. Civ. Code §1798.150.
- HIPAA, GLBA, and other sector-specific breach regimes that may apply in parallel.
- Third-party / service-provider notification chains required by contract.
- Substitute notice (mass-media + website + email combination) when the cost or volume thresholds in §1798.82(j) are met.
Sources
- Cal. Civ. Code §1798.82 (data-breach notification duty, mandatory headings, 10-point minimum, 30-day clock, 15-day AG sample-copy rule, 12-month identity-theft services trigger) — leginfo.legislature.ca.gov
- California Attorney General — data-breach reporting program and sample-submission portal: oag.ca.gov/privacy/databreach/reporting