Breach Notification Letter Templates: What Each Regime Requires Yours to Say

Key takeaways

• A notification letter is a contents list, not a composition. State statutes, GDPR Article 33(3), and HIPAA 45 CFR 164.404(c) each name the required elements. The work is filling blanks, not writing prose.
• The regimes overlap, but no single letter satisfies all of them. Every letter answers what happened, what data, and what you are doing. The edges bite: Massachusetts bars the nature of the breach from the consumer letter, Connecticut can require two years of credit monitoring, HIPAA wants two dates most state letters omit.
• Write the skeletons in peacetime. The clocks run while forensics is still counting. Counsel-approved letters attached to the plan turn the deadline into a fact-filling exercise.
• Plain language is a legal requirement, not a style preference. HIPAA requires the individual notice be written in plain language; GDPR requires the individual communication be in clear and plain language.
• Your letters will be compared. Florida and Massachusetts both require a copy of the customer letter to reach the attorney general. Letters that contradict each other are contradiction on file.

Why these letters get written before the incident

The clocks start at discovery, not at understanding. GDPR asks the regulator for a notification within 72 hours of awareness, and the state layer runs deadlines as short as 30 days in some states. Forensics rarely finishes inside the shortest clock, so the letter is drafted while facts are still partial.

That is what a template pack buys you: element headings, placeholder slots, and counsel-approved stock language, reviewed in peacetime and sitting as an annex to the incident response plan template. During the incident, someone fills the slots with confirmed facts from the breach response checklist log, and the letter goes out.

Pre-drafting also settles the hold-versus-confirm decision: wait for the investigation to complete, or send a partial-facts notice now. The statutes answer most of it. GDPR lets information be provided in phases without undue further delay (Article 33(4)). Massachusetts forbids delaying notice on the grounds that the total count is unknown, and requires supplemental notice as more is learned. HIPAA's date elements carry "if known." The rule that survives all three: send only confirmed facts, send them when the earliest clock forces them, and pre-commit the follow-ups.

The state-law core: what a US notice must contain

All fifty states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have breach notification statutes covering private businesses, and in most states government entities as well (NCSL's summary of state breach laws). The statutes typically define who must comply, what counts as personal information, what counts as a breach, the timing and recipients of notice, and exemptions such as encrypted data.

Reading the statutes cited below, a core recurs: what happened and roughly when, the types of personal information involved, what the organization is doing or offering, and how to reach a human. Florida's individual-notice list is the shortest verified version: the date, estimated date, or estimated date range of the breach; a description of the personal information accessed or reasonably believed accessed; and information the individual can use to contact the entity (Fla. Stat. § 501.171(4)(e)). Other statutes add to that core rather than replace it.

The variations are mandatory content, not tone:

• Massachusetts sets the richest regulator letter and the oddest consumer letter. The notice to the attorney general and the director of consumer affairs must include, among other items: the nature of the breach, the number of Massachusetts residents affected, the name and address of the entity that experienced it, the name and title of the person reporting and their relationship to the entity, the type of entity, the person responsible if known, the type of personal information compromised, whether the entity maintains a written information security program, and the steps taken or planned (Mass. Gen. Laws ch. 93H, § 3(b)). The consumer notice must state the right to obtain a police report, how to request a security freeze and what to provide, that there is no charge for the freeze, and the mitigation services provided. And the statute bars the consumer notice from including the nature of the breach or the number of residents affected. A sample copy of the consumer notice goes to the attorney general and the consumer affairs office.
• Florida runs a 30-day clock and demands the notice itself. For breaches affecting 500 or more individuals in the state, the written notice to the Department of Legal Affairs must arrive as expeditiously as practicable and no later than 30 days, with a 15-day extension only on written good cause. It must include a synopsis of events, the number of individuals in the state affected, any services being offered without charge and how to use them, a copy of the notice required for individuals, and a contact name, address, phone, and email (Fla. Stat. § 501.171(3)).
• Connecticut prices in credit monitoring. Residents get notice without unreasonable delay and not later than 60 days, and the attorney general gets notice not later than the time residents are notified. If Social Security numbers or taxpayer identification numbers were breached, the entity must offer identity theft prevention services at no cost for not less than two years, include enrollment information, and explain how to place a credit freeze (Conn. Gen. Stat. § 36a-701b(b)).

The working approach for the state layer, and the deeper guide to the state breach notification laws, is one master letter with state-specific addenda: the core carries every state, and each state's mandated extras bolt on as blocks.

GDPR: what Article 33 requires the regulator letter to say

GDPR's 72-hour rule is only half the discipline. The other half is content. Article 33(1) requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If 72 hours pass, the notification must be accompanied by reasons for the delay (Article 33(2)).

Article 33(3) lists what the notification must contain at minimum:

1. The nature of the breach, including where possible the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned.
2. The name and contact details of the data protection officer or other contact point where more information can be obtained.
3. The likely consequences of the breach.
4. The measures taken or proposed to address the breach, including where appropriate measures to mitigate its possible adverse effects.

Information not provided at once may be provided in phases without undue further delay (Article 33(4)). The controller must document every breach, its effects, and the remedial action taken, in a form the authority can verify (Article 33(5)), which is why the pack asks you to keep the drafts you actually sent.

The letter to individuals is Article 34, and it is a different document. When the breach is likely to result in a high risk to rights and freedoms, the controller communicates it to data subjects without undue delay, described in clear and plain language. The communication must cover the nature of the breach plus at least Article 33(3) points (b), (c), and (d): the contact point, the likely consequences, and the measures taken or proposed. Notably absent is point (a)'s categories and counts. The regulator letter counts; the individual letter does not have to. Individual notice is not required where the data was rendered unintelligible (for example by encryption), where subsequent measures ensure the high risk no longer materializes, or where it would involve disproportionate effort, in which case a public communication takes its place (Article 34(3)).

HIPAA: the five elements of the individual notice

The HIPAA breach notification rule is the most prescriptive about wording. Individual notice goes without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of unsecured PHI (45 CFR 164.404(b)). The notice must be written in plain language and contain, to the extent possible (45 CFR 164.404(c)):

1. A brief description of what happened, including the date of the breach and the date of discovery, if known.
2. A description of the types of unsecured protected health information involved, for example full name, Social Security number, date of birth, home address, account number, or diagnosis information.
3. Any steps individuals should take to protect themselves from potential harm.
4. A brief description of what the covered entity is doing to investigate the breach, mitigate harm, and protect against further breaches.
5. Contact procedures for questions, including a toll-free telephone number, an email address, a website, or a postal address.

Two dates, both marked "if known." That is the rule's own acknowledgment that you write this letter mid-investigation.

The same five elements travel. A breach of unsecured PHI involving more than 500 residents of a state or jurisdiction triggers notice to prominent media outlets serving that state, within the same 60 days, and the media notification must meet the content requirements of 164.404(c) (45 CFR 164.406). Breaches of 500 or more individuals are reported to the HHS Secretary contemporaneously with the individual notice, in the manner specified on the HHS website; breaches under 500 go into a log submitted within 60 days after the end of the calendar year (45 CFR 164.408). The Secretary submission is a portal form, not a letter, so the pack covers what you control: the notice itself.

The anatomy of the customer letter

Whatever the regime, the letter to an affected person has a shape, and the pack walks it part by part:

1. A subject line that says what it is. "Notice of a data incident." No branding, no "important update."
2. The opening fact. What you are writing about and the date you discovered it.
3. What happened. Confirmed facts only, the date or estimated date range, no cause narrative. Two or three sentences.
4. What information was involved. The types in plain words: names plus Social Security numbers, addresses, health data. Types, not record inventories.
5. What we are doing. The investigation, the forensics help if engaged, containment and fixes, in plain verbs.
6. What you can do. The practical steps: place a freeze, review statements, watch for specific harms. Massachusetts tells you exactly what belongs here.
7. What we are providing, if anything. Monitoring or mitigation, enrollment steps, cost to the recipient. Only what is funded and approved.
8. How to reach us. A real line, staffed hours, an address or email.

One page. Plain language is a statutory requirement under HIPAA and GDPR, not a courtesy. Every factual sentence should trace to the investigation log, because the sentence you cannot source is the sentence you retract.

What no letter should ever say

• No scope claims before confirmation. "All affected customers," "only a subset," "no data was accessed." These age worst, and two states file your customer letter with the attorney general, where revision history is visible.
• No cause before forensics names it. Early cause statements get amended, and amendments get quoted next to the original.
• No safety promises. "No risk of misuse" is a promise no one can keep, and it reads as spin even when sincere.
• No blame narratives. Attackers, vendors, ex-employees. Blame creates exposure and burns goodwill you will need later.
• No security detail that helps the attacker. The unpatched system, the entry point, while it is still open.
• No off-script voice. One spokesperson, consistent facts, counsel review on every letter. The crisis communications discipline exists because every letter is a legal artifact that can be read back to you.

How the letter pack is organized

The download contains four annotated skeletons, one per audience:

• The individual letter (state law). The core elements, with optional blocks keyed to the variations above: freeze language, the monitoring offer, the Massachusetts-specific wording rules.
• The attorney general letter. Modeled on the statutory lists in Massachusetts and Florida: the nature and synopsis, the state-resident count, the entity and reporter identity, the type of information, the WISP status where a state asks, the steps taken, the services offered, and the copy of the consumer notice.
• The GDPR lead supervisory authority notification. The four Article 33(3) elements in order, the phased-notification plan, and the reasons-for-delay paragraph in case the 72 hours have passed.
• The HIPAA individual notice. The 45 CFR 164.404(c) five elements in plain-language form, with the two dates separated from the start.

Each element carries three annotations: what it must contain, which provision asks for it, and why it is there. The Article 34 communication to EU or UK data subjects reuses the individual skeleton with the GDPR element swaps: nature, contact point, likely consequences, measures, and no counts. Build once, adapt per regime.

Frequently asked questions

Can one letter satisfy every regime? The overlap is heavy, so one master notice with per-regime addenda usually works. The exceptions are real: a Massachusetts consumer letter that describes the breach's nature violates that statute's wording rule, and a HIPAA letter must carry its five elements in plain language. The pack's answer is a master skeleton with per-regime blocks, not one frozen letter.

Do we send before the investigation is finished? Usually yes, partially. GDPR expects phased information, Massachusetts requires notice even when the count is unknown with supplements to follow, and HIPAA's date elements carry "if known." Send confirmed facts on the earliest clock, pre-commit the follow-ups, never send unconfirmed scope.

How long should the letter be? Individuals: one page. Attorney general letters: as long as the statutory list and no longer. The HIPAA rule itself asks for brief descriptions. Brevity is also risk control, because every extra sentence is another sentence to defend.

Do we have to offer credit monitoring? Sometimes, by statute. Connecticut requires not less than two years at no cost when Social Security numbers or taxpayer IDs were breached; Massachusetts letters must state the mitigation services provided. Elsewhere it is a risk decision. Promise only what is funded and approved, because a broken monitoring promise becomes its own legal problem.

Free download: every deadline these letters answer to, on one page: Breach Notification Clocks cheat sheet (PDF, one page) →