15-day AG sample notice
For incidents affecting 500+ California residents, a sample consumer notice must be submitted to the California Attorney General within 15 days of sending notices to consumers.
The most rigorous breach notification engine a company can deploy.
NotifyRight assembles a defensible, on-time notification package — every jurisdiction's obligation determined, every consumer notice and regulator filing drafted and filed, with a licensed privacy attorney as the sign-off chokepoint.
Every U.S. state + DC/territory breach law mappedHIPAA, GLBA, and sector rules includedAttorney-signed obligation determination48–72 hour SLA for obligation analysisAudit-ready compliance file
Why notifications fail
A single missed jurisdiction or blown deadline can trigger fines and lawsuits.
When a data breach is confirmed, a brutal clock starts. You must figure out — often in days — which of the affected people trigger a notification obligation, in which of the 50+ U.S. jurisdictions, by exactly when, with exactly what content, and to which regulators, attorneys general, consumer reporting agencies, and media outlets.
The rules conflict: California demands a sample notice to the Attorney General within 15 days of notifying 500+ residents; New York, Colorado, Florida, and Washington impose hard 30-day consumer deadlines; HIPAA requires notice to HHS within 60 days for breaches of 500+ records. Getting any of this wrong is expensive — the average U.S. breach now costs $10.22M, and late breach-reporting is the second most common reason for HIPAA financial penalties.
Most organizations face this rarely and unprepared, relying on manual 50-state spreadsheets built under deadline pressure. That is exactly where gaps hide.
NotifyRight exists to close that gap with a single, exhaustive standard applied identically to every incident.
$10.22M
average U.S. data breach cost in 2025
The benchmark
Measured against every jurisdiction's statute — subsection by subsection.
We do not summarize the law and hope. Every notification package is scored against a versioned rule pack tied to the exact text of each state's breach notification law, HIPAA, GLBA, and sector rules. These are the provisions each package is held to.
30-day consumer deadline
New York requires consumer notification within 30 days of breach confirmation. Other states like Colorado, Florida, and Washington impose similar hard deadlines.
HIPAA individual notice
Covered entities must notify affected individuals without unreasonable delay and in no case later than 60 days from breach discovery for breaches of 500+ records.
HIPAA media notice
For breaches affecting 500+ residents, covered entities must notify prominent media outlets serving the state or jurisdiction.
Consumer reporting agency notice
Most states require notification to nationwide consumer reporting agencies when the affected population exceeds a threshold (typically 1,000 residents).
Attorney general notification
Many states require a copy of the consumer notice to be filed with the state attorney general or consumer protection agency, often with specific timing and content requirements.
How a package is built
Intake to attorney release, with deterministic gates the AI cannot overrule.
AI extracts and drafts. Deterministic rules — running as code, outside the model — decide what is complete. A licensed privacy attorney reviews the obligation determination and signs. That order is never reversed.
01
Obligation Scan
Upload the incident facts: affected population by state, data elements exposed, entity type. We return a free obligation analysis: which jurisdictions require notice, by when, and to whom.
02
Jurisdiction mapping & deadline calendar
Our engine maps each affected individual's residency and exposed data to each jurisdiction's trigger, computes the binding deadline calendar, and identifies all required recipients (regulators, AGs, CRAs, media, HHS).
03
Drafting
Every consumer notice and regulator filing is drafted to the correct template, incorporating jurisdiction-specific content requirements (e.g., description of breach, steps to protect, contact information).
04
Deterministic completeness gates
All deadlines are verified against the statutory calendar; all required recipients are checked; content elements are validated. Any failure blocks release.
05
Attorney review & sign-off
A licensed privacy attorney reviews the obligation determination and signs the compliance file. High-complexity or multi-state incidents route to senior counsel.
06
Delivery
You receive the complete notification package: consumer notices, regulator filings, evidence log, deadline calendar, and an audit-ready compliance file — ready for the organization to send under its own name.
The bar we hold
Rigor you can measure.
100%
Attorney-signed
Every obligation determination is reviewed and signed by a licensed privacy attorney.
48–72 hrs
Obligation analysis SLA
From complete intake to signed obligation matrix and deadline calendar.
<1%
Critical-defect target
Tracked against a gold-standard package library.
50+
Jurisdictions mapped
All 50 states, DC, territories, HIPAA, GLBA, and sector rules.
Why NotifyRight
Built to be the most thorough option an organization has.
Defensible, by design
The deliverable is a complete, on-time, defensible notification — every jurisdiction accounted for, every deadline met, every filing compliant. Nothing is left implicit.
Deterministic, not vibes
The gates that decide completeness are code, not a model's opinion. A drafting error cannot slip past a statutory requirement.
In its lane, on purpose
We prepare documentation and run filings as your clerical agent. We never provide legal advice or make independent legal determinations without attorney supervision.
Engagement
Flat fee, per incident. No hourly billing, ever.
Simple, predictable, and aligned with a documentation standard — not a percentage of any settlement or fine.
- A free Obligation Scan before you commit — see exactly which jurisdictions require notice and by when.
- One flat fee per incident (tiered by number of jurisdictions and affected population); disclosed pass-through filing fees.
- Optional annual breach-ready retainer for pre-approved incident response.
- No contingency, no hourly billing.
FAQ
Questions, answered precisely.
Is NotifyRight a law firm?
No. NotifyRight, a service of Your Deputy, Obuke LLC, provides documentation-completeness and filing services. It is not a law firm, does not provide legal advice, and does not represent you in any legal matter. Attorney review is provided by licensed privacy attorneys who supervise the obligation determination.
Do you contact affected individuals or regulators on our behalf?
No. NotifyRight prepares the notification package and filings, but the organization remains the party responsible for sending all notices and making all filings. We act as your clerical agent.
What makes a package 'complete'?
Completeness is defined by each jurisdiction's statute: every required recipient identified, every content element present, every deadline verified. Deterministic gates enforce each one before attorney release.
How fast is it?
The standard SLA for an Obligation Analysis is 48–72 hours from complete intake. Full notification packages are delivered within the statutory deadlines, typically 5–10 business days depending on complexity.
How are you priced?
A flat fee per incident, tiered by number of jurisdictions and affected population. No hourly billing, no contingency, no percentage of any settlement or fine.
See what's missing before it costs you a fine.
Start with a free Obligation Scan. Send your incident facts and we'll return a jurisdiction-by-jurisdiction obligation matrix and deadline calendar — signed by a licensed privacy attorney.
Documentation-completeness service · not legal advice · the organization sends every notice.