From data-breach-response-skills
Coordinates data breach notifications across EU GDPR, US state laws, and international regimes, resolving timeline conflicts and determining lead supervisory authorities.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin data-breach-response-skillsThis skill uses the workspace's default tool permissions.
When a data breach affects individuals across multiple legal jurisdictions, the controller must navigate overlapping and sometimes conflicting notification requirements. The EU GDPR imposes a 72-hour supervisory authority notification deadline; US state laws impose varying timelines and content requirements; and other jurisdictions (Canada, Australia, Brazil, Japan, South Korea) have their own ...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
When a data breach affects individuals across multiple legal jurisdictions, the controller must navigate overlapping and sometimes conflicting notification requirements. The EU GDPR imposes a 72-hour supervisory authority notification deadline; US state laws impose varying timelines and content requirements; and other jurisdictions (Canada, Australia, Brazil, Japan, South Korea) have their own regimes. This skill provides the framework for coordinated notification across jurisdictions.
| Element | Requirement |
|---|---|
| SA notification timeline | 72 hours from awareness (Art. 33(1)) |
| SA notification threshold | Unless breach is "unlikely to result in a risk" |
| DS notification timeline | Without undue delay when "high risk" (Art. 34(1)) |
| Lead SA determination | One-stop-shop: Art. 56 lead SA based on main establishment |
| Cross-border mechanism | Lead SA notified; other concerned SAs informed via Art. 60 |
| Content requirements | Art. 33(3)(a)-(d) for SA; Art. 34(2) for data subjects |
| State | Timeline | AG Notification | Threshold | Key Differences |
|---|---|---|---|---|
| California | Most expedient time possible, no unreasonable delay | Yes, if 500+ CA residents | Name + specified data element | Substitute notice for 500,000+ affected; specific template for health data |
| New York | Most expedient time possible, no unreasonable delay | AG, DFS, DOCS simultaneously | Private information (name + data element) | SHIELD Act: 30-day AG notification for NY residents |
| Texas | 60 days from determination | AG if 250+ TX residents | Name + sensitive personal information | Expanded definition of sensitive data includes biometric identifiers |
| Florida | 30 days from determination | FDLE within 30 days if 500+ | Name + specified data element | One of the shortest statutory deadlines |
| Massachusetts | As soon as practicable | AG + OCABR simultaneously | Name + specified data element | Requires description of remedial services offered |
| Illinois | Most expedient time possible, no unreasonable delay | AG if 500+ IL residents | Name + specified data element | BIPA adds biometric data breach notification requirements |
| Virginia | 60 days from discovery | AG + affected individuals | Name + specified data element | VCDPA adds consumer data rights context |
| Colorado | 30 days from determination | AG within 30 days if 500+ | Name + specified data element | Among the shortest deadlines alongside Florida |
| Pennsylvania | Without unreasonable delay | AG if notifying | Name + specified data element | Broad definition of personal information |
| Washington | 30 days from discovery | AG within 30 days if 500+ | Name + specified data element | Biometric and health data included |
| Jurisdiction | Law | SA Timeline | DS Timeline | Notable |
|---|---|---|---|---|
| United Kingdom | UK GDPR + DPA 2018 | 72 hours (ICO) | Without undue delay | Mirrors EU GDPR; ICO is sole SA |
| Canada | PIPEDA + provincial laws | "As soon as feasible" to OPC | "As soon as feasible" | Real risk of significant harm (RROSH) threshold |
| Australia | Privacy Act 1988 (NDB scheme) | 30 days to OAIC | As soon as practicable | "Eligible data breach" = serious harm likely |
| Brazil | LGPD | "Reasonable time" to ANPD | "Reasonable time" | ANPD defines timeframes by regulation |
| Japan | APPI | Promptly to PPC (3-5 days recommended) | Promptly | Mandatory for 1,000+ subjects or sensitive data |
| South Korea | PIPA | Within 72 hours to PIPC | Without delay | Mirrors GDPR timeline |
| Singapore | PDPA | 3 calendar days to PDPC | As soon as practicable | Significant harm or significant scale threshold |
When notification timelines conflict, always prepare to meet the shortest applicable deadline. This typically means:
Prepare a single core notification document containing the superset of all content requirements across jurisdictions, then adapt for jurisdiction-specific formatting:
| Content Element | GDPR Art. 33(3) | California CC §1798.82 | New York GBL §899-aa | Texas BCC §521.053 |
|---|---|---|---|---|
| Nature of breach | Required | Required | Required | Required |
| Data categories affected | Required | Required (specific elements) | Required | Required |
| Data subject count | Required (approximate) | Not required but recommended | Required | Required |
| DPO/contact details | Required | Contact details required | Contact details required | Contact details required |
| Likely consequences | Required | Not explicitly required | Not explicitly required | Not explicitly required |
| Measures taken | Required | Remedial actions required | Remedial actions required | Required |
| Credit monitoring offer | Not required (but common) | Required for SSN/financial | Recommended | Required for SSN |
| SA notification reference | Required | AG notification required | AG notification required | AG notification required |
Manage notifications through parallel workstreams:
Track 1: EU/UK GDPR (72-hour priority)
Track 2: US State Notifications (varies by state)
Track 3: Other International Jurisdictions
For Stellar Payments Group with main establishment in Berlin, Germany:
In some jurisdictions, law enforcement authorities may request a delay in data subject notification to avoid prejudicing a criminal investigation: