# Notify a breach

URL: /workflows/processes/notify-regulator/notify-breach · Id: `workflow:notify-breach`

> Notify a breach tells each regulator and affected Person about a personal-data breach within the legal deadline, which counts from awareness.

Notify a breach tells each regulator and affected [Person](/business/nouns/person) about a personal-data breach within the legal deadline, which counts from awareness.

## Trigger
Runs on `Incident.created` where `personalData = true`. Part of [Notify regulator](/workflows/processes/notify-regulator), run by the [Legal Team](/agents/legal).

## Steps
1. Record when the Startup became aware: every deadline counts from then.
2. List the affected records, each Person they belong to, and their Markets.
3. Draft each regulator notice from the Incident and the affected Markets.
4. Send each notice before its deadline, signed where the law requires a signer.
5. Tell each affected Person when the risk to them is high.

## Outputs
- [Document](/business/nouns/document)
- [Message](/business/nouns/message)

## Example
An [Incident](/business/nouns/incident) exposes the emails of 2,000 EU [Customers](/business/nouns/customer). The regulator notice goes out 50 hours after the [Startup](/business/nouns/startup) became aware, inside the 72-hour deadline. No one is told directly, because exposed emails alone are low risk.