Data breach notification checklist template that runs on vendor inputs

A data breach notification checklist template lists the steps from the first alert to the proof of the last notice: contain and investigate, record the determination, notify the insurance regulators within their short clocks, identify the affected people and their states, work out which notices each state requires, draft and approve every letter, mail them, tell the attorneys general and credit bureaus, keep the proofs and update the regulators as the facts change. For an insurer the template has to do one more thing, because most of those steps wait on an outside firm. The forensic investigator supplies the facts, the data-review vendor supplies the people, the print house supplies the mailing proofs, and when the breach is at a vendor, the vendor's own notice starts the clock. A checklist that lists tasks without the inputs they wait on will look complete and still run late.

The checklist on this page is the one Botminds' Data Breach Notification Management runs on every incident, written out so a team can use it by hand. In the solution five AI agents take the vendors' outputs as they arrive, apply each state's breach law and insurance data security law, draft every notice and keep every clock, and named people at the insurer decide and sign. The dates come from its fictional sample incident: a ransomware attack on the vendor that scans Wrenfield Mutual's claims mail.

"State breach notification laws typically tell you what information you must, or must not, provide in your breach notice."

Federal Trade Commission, Data Breach Response: A Guide for Business (August 2023)

What should a data breach notification checklist include?

It should include every notice the law can require, the event each one's deadline runs from, the person who signs it, and the input it cannot be written without. Generic incident response checklists cover the first half of an incident well: assemble the team, secure the systems, preserve evidence, fix the hole. NIST's incident response profile, revised in April 2025, asks organisations to "Follow established procedures concerning incident coordination that include what must be reported to whom and at what times". A notification checklist is that procedure written down for one legal regime at a time.

For an insurer that means two regimes. Insurance data security laws, modelled on the NAIC's, require notice to commissioners within 72 hours or a few business days of a determination. State breach laws require letters to residents and notices to attorneys general, agencies and credit bureaus within 30 to 60 days. The checklist below runs both in one sequence, in the order the deadlines fall.

The checklist, step by step, with owners and vendor inputs

Each step names its owner and the input it waits on. Where the input comes from outside the insurer, the step is only as fast as the contract with that firm, which is why the inputs are worth agreeing before an incident rather than during one.

The breached vendor's own notice is the first input

When the breach is at a vendor, the date the vendor tells you can start your regulatory clocks before you have decided anything, so the checklist's first line is to log it. The model law starts a licensee's deadlines for a vendor's event on the day after the vendor's notice, or on the day the licensee otherwise had actual knowledge, whichever is sooner. It also leaves the investigation with the insurer: if an event may have occurred in a vendor's system, the licensee "will complete the steps listed in Section 5B above or confirm and document that the Third-Party Service Provider has completed those steps".

Breach laws set the vendor's side of the bargain. Florida requires a third-party agent to notify the company it serves "no later than 10 days following the determination of the breach of security or reason to believe the breach occurred", and to provide "all information that the covered entity needs to comply with its notice requirements". Texas and California require a company holding someone else's data to tell the owner immediately. Florida adds that a vendor's failure to give proper notice on the company's behalf is treated as the company's violation, so delegating the letters does not delegate the liability.

In the sample incident the vendor detected ransomware on Sunday 13 September and told Wrenfield at 17:30 on Monday 21 September, eight days later. Wrenfield's commissioner clocks started at midnight that night. A contract that required notice within 48 hours of detection would have moved every deadline in the incident a week earlier, and given a week more to meet them.

Contract terms that make the checklist run on time

Most of the inputs on the checklist arrive under a contract, so the checklist is only as fast as the contracts allow. Five terms decide it. The breached vendor's notice period: how soon after detecting an event it must tell you, measured from detection rather than from the end of its investigation. Its duty to give you what you need to notify, which Florida already imposes on a third-party agent. Who sends which notices, since the model law lets a licensee agree that a vendor will carry out the notices, while Florida treats a vendor's failure to notify properly as the company's own violation.

For the firms that help after an incident, the terms are about form and speed. The data-review vendor should deliver rows by person and data element, with the address it found, in a format the privacy office can merge without retyping. The print house should commit to a lead time in business days and return a job number for each batch as proof of mailing. Agreed in advance, these are a page of an incident response plan; negotiated during an incident, they cost days.

Data breach response plan template: what the regulators require it to cover

Insurers do not get to choose whether to have a response plan; the insurance data security laws require one in writing, and the checklist should be part of it. The model law requires an incident response plan that addresses seven areas: the internal process for responding, the plan's goals, "clear roles, responsibilities and levels of decision-making authority", external and internal communications, remediation of weaknesses, documentation and reporting of events, and evaluation and revision of the plan after an event.

New York's regulation, for licensed insurers there, asks for more. Its plans must address the same ground and add recovery from backups, a root cause analysis of how and why the event occurred and what will prevent it again, and plans for different types of event, "including disruptive events such as ransomware incidents". It also requires business continuity and disaster recovery plans that identify the third parties needed to keep systems running. A response plan that names those third parties and the inputs each owes the insurer is most of a notification checklist already.

The model also sets the retention rule a checklist should end with: records concerning every cybersecurity event kept for at least five years from the event, and produced on the commissioner's demand. That covers the decisions as well as the notices, including any written finding that a harm test excused a letter.

How the inputs flow, from the forensic firm to the print house

Laid end to end, the checklist is a relay between firms. The forensic firm's findings feed counsel's determination and the commissioner notices. The data-review vendor's file feeds the people and the states. Counsel's rules feed the plan. The print house's job numbers close the loop. Each hand-off is a place where a day can be lost or gained.

Data breach notification process steps in the first ten days

The first ten days decide whether the rest of the incident runs on time, and in an insurer they divide into three: the regulator notices in the first three days, the data review in the next week, and the drafting of letters as soon as the review is stable. In the sample incident the commissioner notices were filed on 23 and 24 September, within three days of the vendor's notice. The data review that placed 48,016 people in 20 states was not final until 9 October, eighteen days after it.

The lesson for a checklist is that the commissioner step cannot wait for the people step. The model law asks for the best estimate of affected consumers in the first report, to be updated with each later one, and in the sample incident the eight commissioners were first told 46,900 people, then sent an update when the data review found 48,016. A checklist that puts "identify affected people" before "notify regulators" will miss the regulators.

Who does the work: the firms on an insurer's checklist

The vendors are not interchangeable, and each one's output is another's input. The useful question about each is not what it does but what it hands over, in what form and how fast.

What the letter step needs: content, extras and the forbidden

The letter step needs a base letter and each state's additions and subtractions, and the checklist should hold them as versions, not as edits made under deadline. Most states require the date or range of the breach, the kinds of information involved and how to reach the company; some prescribe a format, as California does with its "Notice of Data Breach" title and set headings. Some add services: California requires an offer of identity theft prevention and mitigation services for not less than 12 months when the company was the source of a breach that exposed Social Security, driver's licence or other government identification numbers, and Delaware requires a year of free credit monitoring for exposed Social Security numbers unless it is determined that harm is unlikely.

Some states subtract. Massachusetts forbids its letter to describe the nature of the breach or the number of residents affected, which every other letter tends to include. The detail of each state's rules is in data breach notification laws by state; for a checklist, the point is that the letter step ends with a named, counsel-approved version per state, and the mailing step can prove which version went to whom.

Each paragraph of a state letter, with the reason it is there

Settings to fix before an incident

Several of the checklist's decisions can be made once, in calm, and applied to every incident: how close to a deadline a notice turns red, what lead time the printer needs, what default to plan to where a statute gives no number of days, how long identity protection runs, and who signs each kind of notice. Fixing them in advance removes a dozen arguments from the first week of an incident.

The checklist's standing decisions, set once

The 30-day default for statutes that say only "without unreasonable delay" is a deliberate choice. Massachusetts gives no number of days, nor, in the sample rules, do several other states, and a team without a default plans to the latest date it can defend. Planning to 30 days from the determination keeps those states in step with the strictest fixed deadlines. For the market of tools that run this checklist, see data breach notification software companies.

Questions people ask

Is there a data breach notification checklist PDF from a regulator?

The Federal Trade Commission publishes a free guide, Data Breach Response: A Guide for Business, last updated in August 2023, with steps and a model letter. It is written for businesses generally; an insurer has to add the insurance commissioner notices, which run on shorter clocks.

What are the steps in the data breach notification process?

Investigate and record the determination; notify the insurance regulators; identify the affected people and their states; work out each state's notices; draft, approve and mail the letters; notify attorneys general, agencies and credit bureaus; keep the proofs; and update the regulators. Harm-based exceptions are decided by counsel in writing along the way.

How is a breach response checklist different from a notification checklist?

A response checklist covers containment, investigation, evidence and repair. A notification checklist covers who must be told, by when, with what content and with what proof. Insurers need both, and the insurance data security laws require the first as a written incident response plan.

When should law enforcement be notified of a data breach?

Early. The FTC's guide says: "Call your local police department immediately." Many breach laws, including Texas's and Florida's, allow the letters to be delayed if a law enforcement agency asks, so the request should be in writing and dated.

How long should records of a data breach be kept?

At least five years from the event under the NAIC model law, which requires the records to be produced on the commissioner's demand. Florida also requires a written harm-based decision not to notify to be kept for five years.