Notification Counsel Lab
Practise the judgement behind breach notification. Three fictional clients, three decisions: whether a lost, "encrypted" laptop is reportable, how HIPAA and a state law fit together, and how one incident splits across processor, controller and securities-issuer roles.
Each fact pattern is scored on seven decisions, with a seeded "how it played out" step, named classic mistakes, and a case memo and register you can download with Pro. The existing breach notification clock calculator computes deadlines. This lab is about the judgement that comes first.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
You are outside breach-notification counsel at Marlowe Vance LLP
Marlowe Vance LLP is a fictional law firm with a breach notification practice. Three clients call in the first days after an incident and ask the lawyer's questions: is it reportable, under which regime, who has to be told and what do we say. A calculator can tell you a deadline once you know which regime applies. You are the one who decides that. All parties are fictional. The legal rules named are real and were checked against the sources listed on the page.
- 1Issue spotting: Is this reportable, and what is the real notification question?
- 2Governing regime and test: Which regime and which test decide it?
- 3Strategy and timing: How do you sequence the response against the clocks?
- 4Risk assessment and record: What do you document, and when?
- 5Who must be notified: Who has to be told? Tick every notice that belongs.
- 6What the notice says: What goes in the notice?
- 7Next step: What do you do next?
- 8See how it played out, from a seeded outcome
3 fact patterns. Pro keeps the rules in a fold-out and hides the hints. A good record choice uncovers hidden complications as you go. Passing score is 70%.
Loading…
TL;DRWhat this lab is
4 points
- A fictional-client practice lab for breach notification counsel: three fact patterns on triggers, encryption and risk tests, recipients and notice content, with seeded outcomes.
- It is built from real texts (GDPR Arts 4, 33 and 34 and the EDPB guidelines, HIPAA 45 CFR 164.402-.408, Florida Stat. 501.171, SEC Form 8-K Item 1.05) that were opened and checked, listed on the page.
- Educational practice, not legal advice. Rules vary by jurisdiction and change.
- Pro lab: free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the case memos and CSV register is Pro only.
Sources checked
Every rule named in this lab was checked against these pages on 2026-11-02. Law changes, so read the current text before you rely on any of it.
The laptop that was "encrypted"
- GDPR Article 4 definitions (gdpr-info.eu reproduction of Regulation (EU) 2016/679) (reproduction of official text, checked 2026-11-02). Art 4(12) "personal data breach": a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The official EUR-Lex page could not be opened in this session.
- GDPR Article 33 (gdpr-info.eu reproduction) (reproduction of official text, checked 2026-11-02). Art 33(1) controller notifies the competent authority without undue delay and where feasible within 72 hours of becoming aware, unless unlikely to result in a risk; reasons for delay beyond 72 hours; 33(2) processor notifies the controller without undue delay; 33(3) minimum content; 33(4) phased information; 33(5) documentation.
- GDPR Article 34 (gdpr-info.eu reproduction) (reproduction of official text, checked 2026-11-02). Art 34(1) communication to data subjects when the breach is likely to result in a high risk; 34(2) clear and plain language; 34(3) exceptions including data rendered unintelligible, such as by encryption, and subsequent measures.
- EDPB Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0, adopted 28 March 2023 (regulator, checked 2026-11-02). Para 31: "aware" means a reasonable degree of certainty that a security incident has led to personal data being compromised. Paras 76-79: a breach involving properly encrypted data with an uncompromised key and an available backup may not need notifying, but risk must be re-evaluated if the key is later compromised; loss of encrypted data with no backup is an availability breach.
One billing database, three clocks
- 45 CFR 164.402 Definitions: breach and unsecured protected health information (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). An impermissible acquisition, access, use or disclosure is presumed a breach unless a risk assessment of at least four factors shows a low probability the PHI has been compromised.
- 45 CFR 164.404 Notification to individuals (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Notice without unreasonable delay and in no case later than 60 calendar days after discovery; required content elements including a description with dates of breach and discovery, types of information, steps individuals should take, what the entity is doing, and contact procedures.
- 45 CFR 164.406 Notification to the media (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Notice to prominent media outlets for a breach involving more than 500 residents of a State or jurisdiction, within 60 calendar days of discovery.
- 45 CFR 164.408 Notification to the Secretary (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Notice to the Secretary contemporaneously with individual notice for 500 or more individuals; annual notice for fewer.
- Florida Statutes s. 501.171, Security of confidential personal information (Florida Legislature, Online Sunshine) (statute or regulation, checked 2026-11-02). Notice to the Department of Legal Affairs for 500 or more individuals in Florida within 30 days of determination (15 more for good cause); notice to individuals within 30 days; the documented no-identity-theft-or-financial-harm exception after consulting law enforcement; consumer reporting agencies if more than 1,000 individuals; subsection (4)(g) notice under the primary or functional federal regulator's rules.
Processor, controller and issuer in one week
- GDPR Article 33 (gdpr-info.eu reproduction) (reproduction of official text, checked 2026-11-02). Art 33(1) controller notifies the competent authority without undue delay and where feasible within 72 hours of becoming aware, unless unlikely to result in a risk; reasons for delay beyond 72 hours; 33(2) processor notifies the controller without undue delay; 33(3) minimum content; 33(4) phased information; 33(5) documentation.
- SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release 33-11216 (2023) (regulator, checked 2026-11-02). Form 8-K Item 1.05(a) content; General Instruction B: file within four business days after the registrant determines it has experienced a material cybersecurity incident; Instruction 1 materiality determination without unreasonable delay after discovery; Instruction 2 amendment within four business days of determining missing information; Instruction 4 no technical detail that would impede response.
Frequently asked questions
Is this legal advice?
No. It is educational practice with fictional clients. Rules vary by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer.
What does this lab do that the clock calculator does not?
The calculator computes deadlines once you know which regimes apply. The lab practises the earlier judgement: whether an incident is reportable, under which regime and test, who must be told and what the notice says.
Is every deadline "72 hours"?
No. GDPR Art 33(1) says without undue delay and where feasible within 72 hours of awareness. A GDPR processor notifies the controller without undue delay. HIPAA says without unreasonable delay and no later than 60 calendar days. Florida's statute uses 30 days. SEC Form 8-K Item 1.05 uses four business days after a materiality determination. Each depends on its own trigger.
Does encryption always remove the duty to notify?
No. GDPR Art 34 has an exception for data rendered unintelligible, and the EDPB says properly encrypted data with an intact key may not need notifying, but the risk has to be re-evaluated if the key is compromised. Other laws define encryption differently, so check each one.
Do I need Pro to use the lab?
The lab is free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the memos and register is Pro only.
Where do the rules come from?
Each fact pattern lists the statute, regulation and guidance texts opened to check it, with the date checked. The Sources block on the page shows them all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.