Data Breach Notification Letters

Data breach notification can present various layers of complexity for your organization. Not only do you have to ensure affected individuals receive critical information about your data breach event, you also have to notify within the required deadlines and in accordance with applicable laws and regulations.

The art of crafting a notification letter is one that can sometimes be taken for granted – and yet it is your primary communication with stakeholders regarding your data security incident, making it of great significance in controlling your message and quelling breach population fears. There are many nuances, but any good letter will include some basic information:

• All notification letters, within the confines of what’s allowed by law, contain some explanation of the event. Of course, what happened may not be uniform across an entire population – a breach may have distinct recipient populations requiring different letters. This could be based not only upon what was lost or exposed for each group, but also demographic makeup or state-by-state regulatory requirements.
• Contact information will direct individuals to Kroll's call center or another designated source for further information about the breach or identity theft threat that may be present.
• Many state laws require organizations to include information on standard consumer protection rights, such as how to place a fraud alert or credit freeze.
• An organization may choose to include information on what steps are being taken to protect stakeholders’ sensitive information. This may also include information on identity monitoring services that are being provided to the affected population.

Your Kroll team will work with you and your legal counsel to draft a personalized, plain-language communication that provides information about your data breach event, as well as the solutions being offered. We’ll segment your letters by state to address unique regulatory stipulations and will optimize delivery routes to help you meet required deadlines.

Once the letter has been drafted, Kroll will also be on hand to assist with the logistics of mailing, and preparing for responses from your affected population. We will work closely with your team to optimize speed and deliverability, while also reducing unnecessary notification costs. Kroll’s team can work with you to:

• Standardize and scrub your mailing list for optimal delivery
• Assemble the most up-to-date contact information based on the National Change of Address database to improve delivery outcomes
• Eliminate duplicate entries
• Provide you with comprehensive reports that demonstrate and document your best effort to locate, notify and serve those people affected by your event
• Help you compile contact information for incomplete or missing addresses
• Manage returned mail

Once this is completed, we can review your mailing list and separate the groups that require special handling, such as: children, adults, expatriates or decedents. We can separate these categories, identifying which individuals might have special considerations for consumer services, or groups that are at a higher risk based on information lost.