Kansas Data Breach Notification Package
(Template – Court-Ready Draft)
[// GUIDANCE: This package provides (1) a statutory-compliant notice to the Kansas Attorney General and (2) a companion notice to affected Kansas consumers. Each notice is drafted to satisfy Kan. Stat. Ann. §§ 50-7a01 – 50-7a04 and current best practices. Complete every bracketed placeholder, remove all GUIDANCE comments before issuance, and attach any referenced exhibits.]
TABLE OF CONTENTS
- Attorney General Notification Letter
1.1 Document Header
1.2 Section 1 – Incident Overview
1.3 Section 2 – Affected Individuals
1.4 Section 3 – Nature of Personal Information Involved
1.5 Section 4 – Remedial Measures Undertaken
1.6 Section 5 – Consumer Notification Details
1.7 Section 6 – Contact Information & Certification - Attachment A – Consumer Notification Letter (for Kansas Residents)
- Attachment B – Identity Theft Reference Sheet (optional)
1. ATTORNEY GENERAL NOTIFICATION LETTER
1.1 Document Header
Date: [DATE]
To:
The Honorable [NAME]
Office of the Kansas Attorney General
Consumer Protection & Antitrust Division
120 SW 10th Ave., 2nd Floor
Topeka, KS 66612-1597
From:
[LEGAL NAME OF NOTICE-SENDER]
[Street Address]
[City, State ZIP]
Attention: [CONTACT NAME & TITLE]
Telephone: [PHONE] Email: [EMAIL]
Re: Notice of Data Breach Pursuant to Kan. Stat. Ann. §§ 50-7a01 – 50-7a04
[// GUIDANCE: The Kansas statute requires AG notice “when more than 250 Kansas residents are affected.” Send this letter no later than the time you issue consumer notices.]
1.2 Section 1 – Incident Overview
1.1 Discovery Date of Breach: [MM/DD/YYYY]
1.2 Date Breach Occurred (if known): [MM/DD/YYYY – MM/DD/YYYY]
1.3 Date Containment Completed: [MM/DD/YYYY]
1.4 Type of Incident: [Unauthorized Access / Unauthorized Acquisition / Ransomware / Other]
1.5 Brief Narrative of Events:
[INSERT concise, factual chronology—avoid speculative language or admissions of fault.]
1.3 Section 2 – Affected Individuals
2.1 Total Individuals Affected (All Jurisdictions): [NUMBER]
2.2 Kansas Residents Affected: [NUMBER]
2.3 Out-of-State Residents Affected: [NUMBER]
1.4 Section 3 – Nature of Personal Information Involved
The incident involved one or more of the following data elements for the affected Kansas residents:
• [Social Security Number]
• [Driver’s License or State ID Number]
• [Financial Account / Payment Card Number + Required Access Code]
• [Medical / Health Insurance Information]
• [Username + Password / Security Question & Answer]
• [Other – specify clearly]
[// GUIDANCE: Under K.S.A. 50-7a01(g)(1), only disclose data elements that meet the statutory definition of “personal information.”]
1.5 Section 4 – Remedial Measures Undertaken
4.1 Technical & Organizational Controls Implemented:
• [SYSTEM PATCHING, PASSWORD RESETS, ETC.]
• [DEPLOYMENT OF ENDPOINT MONITORING]
4.2 Consumer Protection Measures:
• [12-Months of Complimentary Credit Monitoring with Triple-Bureau Coverage]
• [Fraud Resolution & Identity Theft Insurance Up to $1 Million]
4.3 Law-Enforcement Coordination:
• [REPORT FILED WITH – e.g., FBI IC3, LOCAL POLICE REPORT #]
1.6 Section 5 – Consumer Notification Details
5.1 Notification Method: [First-Class Mail / Email (if E-SIGN compliant) / Substitute Notice]
5.2 Date Consumer Notices Will Be/Have Been Issued: [MM/DD/YYYY]
5.3 Sample Consumer Notice: Attached hereto as Attachment A.
5.4 Nationwide CRA Notice (if > 1,000 individuals): [Yes/No]
5.5 CRA Notification Date (if applicable): [MM/DD/YYYY]
1.7 Section 6 – Contact Information & Certification
Pursuant to Kan. Stat. Ann. §§ 50-7a01 – 50-7a04, [LEGAL NAME OF NOTICE-SENDER] hereby certifies that the information contained herein is accurate to the best of our knowledge as of the date first written above and that consumer notification will be/has been provided in compliance with Kansas law.
Please direct any additional questions to:
[PRIMARY POINT OF CONTACT]
Title: [ ] Phone: [ ] Email: [ ]
Respectfully submitted,
[NAME]
[Title]
[LEGAL NAME OF NOTICE-SENDER]
2. ATTACHMENT A – CONSUMER NOTIFICATION LETTER
(First-Class Mail Template – Kansas Residents)
[COMPANY LETTERHEAD]
[DATE]
[RECIPIENT NAME]
[ADDRESS]
[CITY], [STATE] [ZIP]
Subject: Important Notice of Data Breach
Dear [Customer/Employee/Patient] [LAST NAME]:
Section A – What Happened
On [DATE OF DISCOVERY], we learned that [BRIEF DESCRIPTION OF INCIDENT]. Our investigation indicates the unauthorized activity occurred between approximately [DATE RANGE].
Section B – What Information Was Involved
The information involved may have included your:
• [Social Security number];
• [Driver’s license number];
• [Financial account/payment card number plus security code]; and/or
• [Other personal data elements].
We have no evidence at this time that your information has been misused. However, we are notifying you out of an abundance of caution and in compliance with Kansas law.
Section C – What We Are Doing
• We contained the incident and engaged leading cybersecurity professionals to assist.
• We reported the matter to law enforcement.
• We are providing you [12] months of complimentary credit monitoring and identity-theft protection services through [VENDOR NAME]. Enrollment instructions are enclosed.
Section D – What You Can Do
1. Enroll in Complimentary Services by [ENROLLMENT DEADLINE].
2. Review your credit reports and account statements regularly.
3. Consider placing a fraud alert or security freeze on your credit file. Contact information for the three nationwide credit reporting agencies is provided below.
4. Remain vigilant and promptly report any suspicious activity.
Section E – Credit Bureau Contact Information
• Equifax: P.O. Box 105779, Atlanta, GA 30348, 1-800-525-6285, www.equifax.com
• Experian: P.O. Box 2002, Allen, TX 75013, 1-888-397-3742, www.experian.com
• TransUnion: P.O. Box 2000, Chester, PA 19016, 1-800-680-7289, www.transunion.com
Section F – For More Information
If you have questions, please contact our dedicated response line at [TOLL-FREE NUMBER] Monday through Friday, 8 a.m. – 8 p.m. Central Time or email us at [EMAIL ADDRESS].
This notice is being provided in accordance with Kan. Stat. Ann. §§ 50-7a01 – 50-7a04. This letter does not constitute an admission of liability or wrongdoing.
Sincerely,
[NAME]
[Title]
[COMPANY NAME]
[COMPANY ADDRESS]
Enclosures:
1. Identity Theft Reference Sheet (Attachment B)
2. Credit Monitoring Enrollment Instructions
3. ATTACHMENT B – Identity Theft Reference Sheet (Optional)
[// GUIDANCE: Provide Kansas-focused identity theft resources, e.g., Kansas Attorney General Consumer Protection Hotline (1-800-432-2310), FTC IdentityTheft.gov, SSA fraud line, IRS identity protection, etc.]
ADDITIONAL DRAFTING NOTES
[// GUIDANCE:
• Statutory Timing – “Without unreasonable delay” is interpreted strictly. Document all investigative steps to justify any delay.
• Multi-State Impact – If residents of other states are affected, incorporate each jurisdiction’s unique content/timing mandates.
• CRA Notice – If 1,000+ individuals nationwide are affected, notify Equifax, Experian, and TransUnion without unreasonable delay.
• Preservation of Evidence – Maintain forensic images and investigation memos for at least four (4) years for potential AG inquiry or civil litigation.
• Liability Caps – Kansas imposes statutory penalties under its Consumer Protection Act; no private right of action exists solely under the breach statute, but common-law claims remain possible. Disclaimers above are drafted to mitigate subsequent negligence or contract claims.]
(End of Template)