Breach Notification Letter: Templates & More

A breach notification letter is a formal notice that tells individuals, business partners or regulators that their personal information was exposed in a data security breach. The letter describes the nature of the breach, the categories of data compromised, what the organization is doing in response and how recipients can protect themselves. A breach notification letter is required by law in the event of a breach of personal information: all 50 states, the District of Columbia and the U.S. territories have breach notification statutes, and federal rules add requirements for health information, financial institutions and other regulated data.

The letter should be clear, concise and easy to understand, and it should include every element the applicable statutes require, because regulators review the letters and incomplete notices are a common enforcement finding.

What the letter must say

State statutes vary, but California Civil Code section 1798.82 is the model most organizations follow because it is the most prescriptive. A California notice must be written in plain language, titled "Notice of Data Breach," and organized under the headings "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do" and "For More Information," in type no smaller than 10 point. It must state the name and contact information of the business, the types of personal information involved, the date or date range of the breach, the date of the notice, whether notice was delayed at the request of law enforcement, and a general description of the incident. When Social Security numbers or driver's license numbers were exposed, the notice must include the toll-free numbers and addresses of the three credit reporting agencies and, if the business was the source of the breach, an offer of identity theft prevention and mitigation services at no cost for at least 12 months.

Deadlines

• California: within 30 calendar days of discovering the breach, with a sample copy to the Attorney General within 15 days of notifying consumers when more than 500 California residents are affected (section 1798.82, as amended effective January 1, 2026).
• Other states: most require notice "without unreasonable delay," and about half set an outside limit of 30, 45 or 60 days from discovery. Many also require notice to the state attorney general above a threshold of affected residents, commonly 500 or 1,000.
• HIPAA: covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information (45 CFR 164.404), notify prominent media outlets when more than 500 residents of a state are affected (164.406), and notify the Department of Health and Human Services within 60 days for breaches of 500 or more and annually for smaller breaches (164.408). A business associate has 60 days to notify the covered entity (164.410).
• GDPR: a controller must notify the supervisory authority within 72 hours of becoming aware of a breach (Article 33) and notify data subjects without undue delay when the breach is likely to result in a high risk to them (Article 34).

How the letter is delivered

Written notice by first-class mail to the individual's last known address is the default under state law and HIPAA. Email is permitted when the recipient has agreed to electronic communications. When contact information is missing or the cost of individual notice exceeds a statutory threshold, substitute notice is allowed: a conspicuous posting on the organization's website for at least 90 days, notice to major statewide media, and email to the addresses on file. HIPAA also requires a toll-free number, active for at least 90 days, when 10 or more individuals receive substitute notice.

Drafting notes

1. Have the incident response team confirm the facts before the letter is sent; a notice that is later corrected draws more scrutiny than one sent a few days later.
2. Keep the description of the incident factual and avoid speculating about who was responsible.
3. List concrete protective steps: placing a credit freeze, reviewing account statements, enrolling in the credit monitoring offered, resetting passwords.
4. Match the letter to each state's requirements for the residents receiving it, or draft to the strictest state and add state-specific inserts (Massachusetts, for example, prohibits describing the nature of the breach in the consumer notice).
5. Keep a copy of the letter, the mailing list and the proof of mailing; regulators ask for them.