# Multi-Jurisdiction Breach Notification Workflow

## Phase 1: Jurisdiction Mapping (Within 12 Hours of Breach Awareness)

1. **Identify affected data subjects by residency**: Query the affected database or records to determine the geographic distribution of data subjects.
2. **Map applicable laws**: For each jurisdiction with affected data subjects, identify the applicable breach notification law.
3. **Create notification obligation matrix**: Document for each jurisdiction: notification trigger, timeline, authority to notify, content requirements, and individual notification requirements.
4. **Identify the shortest deadline**: The shortest applicable deadline drives the entire notification preparation timeline.
5. **Assign jurisdiction leads**: DPO leads EU/UK; General Counsel leads US; Regional Privacy Manager leads APAC/other.

## Phase 2: EU/UK Track (72-Hour Priority — Hours 0-72)

1. **Determine lead SA**: Based on main establishment (Berlin → Berliner BfDI).
2. **Prepare Art. 33(3) notification**: Complete all mandatory fields using breach investigation findings.
3. **Assess cross-border impact**: Determine which other EU member states have affected data subjects.
4. **Submit to lead SA**: File notification within 72 hours of awareness.
5. **Phased notification**: If investigation is ongoing, submit initial notification under Art. 33(4) with commitment to supplement.
6. **Art. 34 assessment**: If high risk, prepare data subject notifications in languages of affected member states.

## Phase 3: US State Track (Parallel — Starting Day 1)

1. **State-by-state data subject count**: Generate counts of affected individuals by US state.
2. **Threshold assessment per state**: For each state, determine if the AG notification threshold is met (typically 250-500 residents).
3. **Prepare AG notifications**: Draft state-specific AG notification letters. Many states provide online submission forms.
4. **Prepare individual notifications**: Draft individual notification letters per state content requirements. Use the superset content approach as the base and adapt for state-specific requirements.
5. **Timeline management**:
   - States with specific deadlines (Florida 30 days, Colorado 30 days, Texas 60 days): calendar deadlines and set reminders.
   - States with "without unreasonable delay": aim to notify within 30-45 days.
6. **Credit monitoring**: Where state law requires credit monitoring offer (SSN or financial data breaches), activate vendor enrollment and include activation details in individual notifications.
7. **Submit AG notifications**: File before the statutory deadline for each state.
8. **Dispatch individual notifications**: Send via state-required channels.

## Phase 4: International Track (Parallel — Starting Day 1)

### Canada (PIPEDA)
1. Conduct Real Risk of Significant Harm (RROSH) assessment.
2. If RROSH established, notify OPC "as soon as feasible" using OPC breach report form.
3. Notify affected Canadian individuals "as soon as feasible."
4. Retain breach records for 24 months.

### Australia (NDB)
1. Conduct "eligible data breach" assessment (serious harm likely).
2. If eligible, notify OAIC within 30 days using OAIC NDB form.
3. Notify affected Australian individuals "as soon as practicable."

### Brazil (LGPD)
1. Notify ANPD within 3 business days per ANPD Resolution CD/ANPD 15/2024.
2. Notify affected Brazilian individuals in "reasonable time."
3. Engage Brazilian external counsel (local representation may be required).

### Japan (APPI)
1. Assess whether breach meets mandatory reporting criteria (1,000+ subjects or sensitive data).
2. If mandatory, notify PPC within 3-5 days.
3. Notify affected Japanese individuals promptly.

### South Korea (PIPA)
1. Notify PIPC within 72 hours.
2. Notify affected South Korean individuals without delay.

## Phase 5: Coordination and Conflict Resolution

1. **Timeline conflicts**: When multiple deadlines compete, prepare the EU 72-hour notification first and use it as the foundation for other jurisdiction submissions.
2. **Content conflicts**: Use the superset approach — create one master document containing all content elements required by any jurisdiction, then create jurisdiction-specific versions.
3. **Law enforcement requests**: If any jurisdiction's law enforcement requests a notification delay, comply with that jurisdiction's delay while proceeding with notifications in other jurisdictions unless the delay request explicitly covers all jurisdictions.
4. **Inconsistency management**: Ensure all notifications across jurisdictions are factually consistent. Establish a single source of truth for breach facts maintained by the investigation team.

## Phase 6: Post-Notification Coordination (Ongoing)

1. **Track all authority responses**: Maintain a log of all SA/AG/regulator submissions, reference numbers, and follow-up correspondence.
2. **Supplementary notifications**: Provide updated information to all notified authorities as investigation progresses.
3. **Cross-jurisdiction coordination**: If one jurisdiction's regulator requests information that may affect notifications in other jurisdictions, coordinate the response with all jurisdiction leads.
4. **Close-out**: When all notifications are complete and all authority inquiries resolved, close the multi-jurisdiction coordination file.