Breach notification matrix template: one person, row to letter

A breach notification matrix template is a table with one row for each state where affected people live and one column for each question the law asks: how many residents, which data elements were exposed, whether those elements count as personal information there, the deadline for letters and the event it runs from, the attorney general and credit bureau thresholds, the insurance commissioner notice, and what the letter must and must not say. For an insurer the matrix needs two counts per state, not one, because the insurance data security law and the breach law count different people. And every cell rests on one fact the template cannot supply: where each affected person lives, which comes from the data review, one row at a time.

Building that matrix is most of the work of data breach notification management, and in most insurers it is still a spreadsheet filled in from outside counsel's 50-state survey after the data-review vendor sends the people list. Botminds' Data Breach Notification Management builds it from the rows: AI agents merge the rows into people, place each person in a state, apply each law and draft each notice, and counsel and the privacy officer decide and sign. The figures here come from its fictional sample incident, in which a ransomware attack on Wrenfield Mutual's claims-mail vendor produced 53,477 data-review rows.

"the notice of the breach of system security required under Subsection (b) may be provided under that state's law or under Subsection (b)."

Tex. Bus. & Com. Code §521.053(b-1), on a person who lives in another state

What goes in a breach notification matrix template?

A working template has twelve columns, and three of them are the ones most templates leave out: the event each deadline runs from, the commissioner count, and what the letter must not say. The table sets out each column, where its value comes from and how it reads for one state, Florida, which is a useful example because it counts medical information and has no insurance data security law of the NAIC kind.

Read down the Florida column and a pattern appears: almost every cell is fixed by the statute, and only the counts change between incidents. That is why the law part of a matrix can be maintained once and reused, while the people part has to be rebuilt from the data review every time. A template that mixes the two, with deadlines typed into the same sheet as the counts, gets rebuilt from scratch in every incident and drifts from the law between them.

One person, row to letter

The matrix is easiest to understand from the bottom up, by following one person through it. Take a claimant of the kind the sample incident is full of: an insured driver in Florida whose claim file held a driver's licence number and the bank account used to pay his claim. Suppose he appears in the data review twice, once for his own claim and once in another claim's file. What follows is everything that has to happen before he receives a letter.

Each step changes a cell in the matrix. The merge changes the count of people, the placement decides which row he lands in, the special-case review decides who the letter is addressed to, and the law decides whether he is owed one at all. A spreadsheet matrix usually starts at step four, with counts per state that someone else produced, and inherits every error the first three steps made.

Where the count goes wrong: duplicates, stale addresses and the dead

The count of people is smaller than the count of rows, often by a tenth, and the difference changes thresholds. In the sample incident 53,477 rows held 48,016 people: 5,461 rows were the same person appearing in more than one claim. A matrix built on rows would have overstated every state's count, sent duplicate letters, and in a state near a threshold could have reported to an attorney general who was not owed a notice.

Addresses are the second trap. A claim file holds the address at the time of the claim, which for an old workers' compensation file can be years out of date, and the state of residence is the key to every column. The sample incident sent 1,088 people with no usable address to an address search and 37 that still had none to a review of substitute notice, which Texas and Florida allow when the cost would exceed $250,000, more than 500,000 people are affected, or the company lacks contact information. It also set aside 612 minors, whose letters go to a parent or guardian, and 141 deceased claimants, whose letters go to the estate. None of them fits in a row per state; all of them must be in the matrix.

Two counts per state: the commissioner's and the residents'

An insurer's matrix needs a second count in every state that has adopted the NAIC model law, because the model counts more people than many breach laws do. The model's threshold is 250 or more consumers whose nonpublic information was involved, and nonpublic information includes any information from a health care provider or a consumer about a person's health, the provision of care or payment for it. A breach law that does not count medical information will not owe a medical-only claimant a letter, yet the same claimant still counts toward the commissioner's 250.

South Carolina shows the gap in the sample incident. Its insurance data security act defines nonpublic information to include health information, as the model does, and asks for the number of consumers in the state "affected by the cybersecurity event"; the commissioner notice therefore carried everyone in the files, 9,812 once the data review was final, while letters went to 8,904, because medical-only claimants were not owed one under the breach law as the sample rules read it. A matrix with one count column would have under-reported to the commissioner or over-mailed the residents.

Which clock does each deadline column start from?

A deadline column needs two cells, the number of days and the event they run from, because states count from different events. Texas and Florida count from the determination that a breach occurred. Washington counts from discovery. The model law counts commissioner deadlines from the determination, or, for an event at a vendor, from the day after the vendor's notice. California, since 1 January 2026, requires the letters "within 30 calendar days of discovery or notification of the data breach", subject to delays for law enforcement or to determine the breach's scope.

The difference can be a full day or more on the same incident. In the sample, the vendor's notice arrived on Monday 21 September and counsel recorded the determination on Tuesday 22 September. A matrix that writes "30 days" without the start event leaves the analyst to pick one, and the safe habit of counting every deadline from the earliest event works only until a team relaxes it under pressure. How the two kinds of clock run side by side is the subject of the insurer's two clocks.

What the letter column must say, and must not

The content column is a list of required elements with a short list of forbidden ones. California is the most prescriptive: the notice must be titled "Notice of Data Breach" and present its information under the headings "What Happened?" "What Information Was Involved?" "What We Are Doing," "What You Can Do," and "For More Information.", in type no smaller than 10 point, and it must include toll-free numbers for the credit bureaus when a Social Security, driver's licence or California identification number was exposed. Florida's minimum is shorter: the date or range of the breach, what was accessed, and how to contact the company. Washington lists its own required elements.

The forbidden list is short but unforgiving. Massachusetts forbids its letter to say what a letter in every other state says, the nature of the breach and the number of residents affected, and the sample incident's Massachusetts letters were redrafted to leave both out. The state-by-state detail is in data breach notification laws by state. In a matrix, the content column should point to a letter version, not describe one, so that the version mailed can be proved.

State data breach notification chart or matrix: which do you need?

You need both, and they answer different questions. A state data breach notification chart describes the law: one row per state, the same for every company and every incident, kept current as statutes change. A breach notification matrix describes an incident: the chart's rules applied to your people, with counts, owed and not owed, dates and proof. The chart answers "what does Ohio require"; the matrix answers "what do we owe Ohio this time, by when, and have we sent it".

Published 50-state charts are useful for the first question, but they date quickly, because the statutes keep changing: California's fixed 30 days took effect on 1 January 2026, and Florida's statute was amended again in 2026. For an insurer a general chart also misses the insurance data security laws, which sit in insurance codes rather than consumer-protection statutes. The chart an insurer keeps should be its counsel's own, dated and versioned, with both kinds of law in it.

Checks to run on the matrix before anything is mailed

Most matrix errors are visible before a letter is printed, if someone looks for them. These checks catch the ones that change who is owed what.

From spreadsheet to software in Data Breach Notification Management

In the solution the matrix is built from the bottom up. The affected-people mapper turns the rows into people, places each one and lists the elements exposed, and the screen shows each state's people by element, how many are owed a letter and how many are not, with the special cases set aside for claims operations.

The people behind every count, by state and data element

The law half of the matrix lives in a rules table that counsel owns: one row per state with the letter deadline, whether medical information counts, the attorney general or agency and its threshold, the credit bureau threshold, the commissioner notice, the letter requirements and identity protection. The agents apply it and cite it; only counsel changes it.

The law half of the matrix, kept once and reviewed by counsel

Kept apart this way, a change in the law is one edit to the rules table, made by counsel. A new incident is a new set of rows. For the questions to ask any vendor about this split, see data breach notification software companies.

Questions people ask

Is there a breach notification matrix PDF I can use?

A PDF chart can describe the law, but a matrix for an incident has to be a working table, because its counts change as the data review is finalised. Keep the law part as counsel's dated chart and build the incident part from the people list each time.

What is a 50 state data breach notification chart?

It is a summary of each state's breach law: what counts as personal information, the deadline, the agencies and thresholds, and the letter content. For an insurer it should sit beside a second chart of insurance data security laws, which the NAIC lists as adopted in 28 jurisdictions as of its Summer 2026 state page.

How do you handle affected people with no address?

Search for a current address first, and keep the rest in their own list rather than placing them by guess. Texas and Florida allow substitute notice, such as a website posting and media notice, when direct notice would cost more than $250,000, more than 500,000 people are affected, or there is not enough contact information.

Does a data breach notification chart need to include territories?

If you have affected people there, yes. Puerto Rico appears in the NAIC's Model Adoption column for the insurance data security model, through a 2025 regulation, so a Puerto Rico row can owe a commissioner notice as well as letters.

How often should the matrix be updated during an incident?

Whenever the data review changes a count, because thresholds and commissioner notices depend on it. The model law gives a continuing duty to update the commissioner, asking for the best estimate of affected consumers first and updates with each later report.

Who should own the breach notification matrix?

The privacy office usually owns the matrix and counsel owns the rules in it. Claims operations should own the special cases, because the addresses, guardians and estates are in its files.