Nero Labs Breach Notification Rules Engine

{
  "type": "json",
  "example": {
    "verdict": "4 notices owed under 2 laws. First fixed deadline: 2026-10-23 (The competent national data protection authority (lead authority for cross-bo...",
    "disclaimer": "Information, not legal advice. Built from primary government sources (linked per figure); check the source before acting on a close call.",
    "notices_owed": [
      {
        "id": "EU-GDPR",
        "how": "Each national authority's own breach form",
        "law": "European Union and EEA (GDPR)",
        "note": "Read on EUR-Lex. Every breach must be documented, reported or not (Art. 33(5)). Pending change: the European Commission's Digital Omnibus pr...",
        "notify": "The competent national data protection authority (lead authority for cross-border processing)",
        "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
        "citation": "Regulation (EU) 2016/679, Articles 33 and 34",
        "depends_on": [
          "Risk of harm test: Authority notice is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. Individuals..."
        ],
        "notice_type": "data_protection_authority",
        "affected_here": 40,
        "deadline_date": "2026-10-23",
        "deadline_note": "72 hours from becoming aware: the date shown assumes discovery at the start of 2026-10-20; count the hours from the actual time.",
        "deadline_rule": "Without undue delay and, where feasible, no later than 72 hours after becoming aware. If later, give reasons for the delay. Information may...",
        "content_required": [
          "Nature of the breach, with categories and approximate numbers of people and records"
        ],
        "matched_data_types": [
          "ssn"
        ],
        "verified_on_primary_source": true
      }
    ],
    "_example_note": "Real output, trimmed: long lists cut to their first items and long text shortened.",
    "date_discovered": "2026-10-20"
  }
}