# California Breach Notification Workflow

## Phase 1: California Resident Identification (Days 1-5)

1. Query the affected dataset to identify all records associated with California residents using billing address, shipping address, or state identification information.
2. Deduplicate by individual (not by record) to determine the California-specific affected count.
3. If the count equals or exceeds 500, flag for mandatory AG notification.
4. Document the methodology used for California resident determination.

## Phase 2: Notification Preparation (Days 5-20)

### Individual Notification Letter
1. Draft using the five mandatory headings: "What Happened", "What Information Was Involved", "What We Are Doing", "What You Can Do", "For More Information."
2. Ensure 10-point minimum font size.
3. Title: "Notice of Data Breach" (prominently displayed).
4. Include all required content elements per §1798.82(d).
5. If SSN is involved: include credit bureau contact information and security freeze instructions per §1785.11.2.
6. If credentials (username + password) are involved: include specific instructions for password changes and account security.
7. Legal review by California-barred counsel.

### AG Notification Package
1. Prepare the electronic submission for oag.ca.gov/privacy/databreach/reporting.
2. Attach a sample copy of the individual notification letter.
3. Include: breach date, discovery date, California resident count, types of personal information, description of incident.

## Phase 3: Notification Dispatch (Days 20-30)

1. Submit AG notification at oag.ca.gov before or concurrent with individual notification.
2. Dispatch individual notification letters via first-class mail to California residents.
3. For individuals with email consent, send electronic notification.
4. If substitute notice criteria are met (500,000+ affected OR $250,000+ cost), execute substitute notice: email + website posting + statewide media.
5. Retain copies of all notifications, dispatch records, and AG submission confirmations.

## Phase 4: Post-Notification (Day 30+)

1. Staff the toll-free breach response line.
2. Monitor for California AG inquiries or investigation initiation.
3. Track potential CCPA/CPRA §1798.150 litigation risk.
4. Document all costs for insurance recovery purposes.