# Notify regulator

URL: /workflows/processes/notify-regulator · Id: `process:notify-regulator`

> Notify regulator files every notice a notifiable Incident owes before its statutory clock runs out, and records each filing.

Notify regulator files every notice a notifiable [Incident](/business/nouns/incident) owes before its statutory clock runs out, and records each filing.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Each notifiable breach reaches every regulator and affected Person before its legal deadline, and each filing is on record. |
| Reads | [Incident](/business/nouns/incident) |
| Leaves | [Document](/business/nouns/document), [Message](/business/nouns/message) |
| On time | Within 3 days (calendar time); the clock never stops. Late Actions go to the [Legal Lead](/agents/legal/legal-lead). |
| Runs in | Each Startup |

## Accountable
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

Responsible: [Privacy Officer](/agents/legal/privacy-officer).

Consulted: [Legal Lead](/agents/legal/legal-lead), [Security Engineer](/agents/engineering/security-engineer).

Informed: [Founder](/agents/founding/founder), [Communications Lead](/agents/marketing/communications-lead).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | on `Incident.created` where `personalData = true` | [Legal Team](/agents/legal) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | 1. Record when the Startup became aware: every deadline counts from then. | [Privacy Officer](/agents/legal/privacy-officer) | [Incident.update](/business/nouns/incident/update) | None |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | 2. List the affected records, each Person they belong to, and their Markets. | [Privacy Officer](/agents/legal/privacy-officer) | [Collection.query](/business/nouns/collection/query) | None |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | 3. Draft each regulator notice from the Incident and the affected Markets. | [Privacy Officer](/agents/legal/privacy-officer) | [Document.render](/business/nouns/document/render) | None |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | 4. Send each notice before its deadline, signed where the law requires a signer. | [Privacy Officer](/agents/legal/privacy-officer) | [Message.create](/business/nouns/message/create) | None |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) | 5. Tell each affected Person when the risk to them is high. | [Privacy Officer](/agents/legal/privacy-officer) | [Message.create](/business/nouns/message/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | On `Incident.created` where `personalData = true` | Starts [Notify a breach](/workflows/processes/notify-regulator/notify-breach) |
| Out | `Incident.updated` | Raised by step 1 of [Notify a breach](/workflows/processes/notify-regulator/notify-breach) |
| Out | [`Collection.queried`](/business/events/Collection.queried) | Raised by step 2 of [Notify a breach](/workflows/processes/notify-regulator/notify-breach) |
| Out | [`Document.rendered`](/business/events/Document.rendered) | Raised by step 3 of [Notify a breach](/workflows/processes/notify-regulator/notify-breach) |
| Out | `Message.created` | Raised by step 4 of [Notify a breach](/workflows/processes/notify-regulator/notify-breach) |

## Plays
No Play names this Process.

## Controls
No Control names this Process or a Workflow of it.

## Settings
None.

## Failure
A failed step retries; when retries run out, the Action goes to the [Legal Lead](/agents/legal/legal-lead).

| Step | On failure |
| --- | --- |
| [Notify a breach](/workflows/processes/notify-regulator/notify-breach) 4. Send each notice before its deadline, signed where the law requires a signer. | Times out after 3 days. Goes to the [Legal Lead](/agents/legal/legal-lead). |

## Loop
No loop: the path is never randomized, because it serves [Breach notification](/systems/trust-and-governance/controls/breach-notification).

## Code

**Ask**

```text
Turn on notify regulator
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

## Example
An [Incident](/business/nouns/incident) exposes the emails of 2,000 EU [Customers](/business/nouns/customer). Notify regulator files with the lead data protection authority within 72 hours and records the filing on the Incident.