What to do in the hours after a vendor loses your data: contain it, notify on the legal clock, and tell your customers the right way, so you're not writing the playbook mid-crisis.
This is general information, not legal advice. In a real breach, involve your attorney immediately, and confirm the current deadlines for your situation. The deadlines and thresholds below reflect Texas law and can change.
1Contain and document
Do these first, before you notify anyone. Getting the sequence right protects you.
2Who you must notify, and by when
Enter how many people were affected to see your notification duties under Texas law.
Always: notify the affected individuals without unreasonable delay - in practice, as soon as your attorney confirms the facts. Texas requires prompt notice to anyone whose sensitive personal information was exposed.
Because 250 or more Texans are affected: you must also notify the Texas Attorney General within 30 days of determining the breach, using the AG's online breach-report form. Texas AG breach reporting →
Under 250 Texans: the separate Texas Attorney General filing is not triggered, but you still owe the individual notice above, plus any notice your contracts or insurer require. Re-check if the number grows.
Residents of other states affected? Each state has its own clock and rules - flag it for your attorney. Penalties apply for non-compliance; confirm current amounts before relying on any figure.
3Your customer message
Honest, specific, no minimizing. Fill in the brackets, then copy it. Have your attorney review before it goes out.
Copied to clipboard.
4Prevent the next one
The best breach response is not needing one. Three moves that make you far harder to hit through a vendor:
Keep a copy where your team can find it. The plan you have ready beats the one you write mid-crisis.
Get Big Techs every week
Dallas intel for Dallas business - the security, tax, and operator moves most DFW owners miss. Free.