Incident Response
IR-06Make state breach notices and support the bank’s regulatory notices
How Leela would run itEvent-driven · each incident exposing personal information, within each applicable state’s deadline; each bank-made notice, on the bank’s timeline
From the policy libraryThe requirement
Where an incident involves unauthorized access to personal information, outside counsel determines which state breach notification laws apply, and the Company notifies affected individuals, the state attorney general where required, and consumer reporting agencies where required, within each state’s timing, typically 30 days of discovery. Where an incident affects deposit or account services or the Company’s participation in a payment system, the sponsor bank makes the regulatory or operator notice and the Company supplies the incident details on the bank’s clock.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Obtain counsel’s state-by-state determination, send the individual, attorney general, and reporting agency notices it requires, coordinate their timing with the bank, and hand the bank the details for any notice it makes.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Counsel determinationStates affected, notices required, deadlines
- 02Regulatory notice fileEach notice sent or supplied to the bank, recipient, and date
Evidence
Counsel determination
Incident Response §7.1, §7.2
2
of 2 records
The work and the records come from this obligation in the policy library.