Notification: Content of the Letter
About half of states mandate specific content (incident description, approximate date, data types, steps taken, contact phone, identity-theft steps, CRA contacts, and FTC/AG contacts). Massachusetts is a key exception: it prohibits describing the nature of the breach or the number of residents affected.
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.
- A general description of the incident and an approximate date
- The type of personal information subject to unauthorized access/acquisition
- General acts the business took to protect the information
- A telephone number and conspicuous website notice for further assistance
- Steps the person may take to protect against identity theft
- Toll-free numbers and addresses for the major CRAs
- Contacts for the FTC and the relevant offices of attorneys general
While almost all states want a general description of the incident, Massachusetts prohibits including a description of the nature of the breach or the number of residents affected. A single nationwide letter template can therefore violate Massachusetts law.
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.