Notification decisions require preserved facts
Florida Statutes section 501.171 establishes requirements concerning breaches of security involving personal information. Other federal, sector, contractual, and insurance duties may also apply. A professional office should not improvise the decision while technical evidence is disappearing.
This checklist is operational guidance, not legal advice. Engage qualified counsel to determine coverage and deadlines.
Open a decision record immediately
Record when the event was discovered, who reported it, affected systems, containment actions, and the people authorized to involve counsel, forensics, insurers, and law enforcement. Separate confirmed facts from assumptions.
Identify information and affected people
Document the data elements involved, where they were stored, protection applied, and the population potentially affected. Preserve reproducible queries and explain later changes to the count. Consider email, cloud storage, line-of-business systems, backups, and service providers.
Evaluate access, acquisition, and harm
Preserve sign-in logs, audit events, data-transfer evidence, malware findings, and known limitations. Record who made each determination and the evidence relied upon. Avoid stating that information was not accessed when available logging cannot support that conclusion.
Track every applicable obligation
Create a matrix for Florida law, sector rules, contracts, insurer notice, customer commitments, and law-enforcement coordination. For each, list the trigger, decision owner, deadline, status, and evidence. One notification does not automatically satisfy another requirement.
Preserve submission and remediation evidence
Retain notices, delivery evidence, regulator correspondence, forensic findings, corrective actions, and management approvals according to the retention policy. Feed lessons into risk assessment, vendor oversight, access control, and incident exercises.
A disciplined record lets technical responders focus on containment while leadership makes timely, supportable decisions.
Human-reviewed draft; obtain legal advice before relying on this checklist or issuing notification.