{"uid":"cap_ubZ4c_S55NZ9Ce3pdNAXU","slug":"nero-labs-breach-notification-rules-engine-c2bd76ed","name":"Nero Labs Breach Notification Rules Engine","description":"Pay-per-call tools for AI agents, 31 in all: read web pages and RSS feeds, OCR, PDF text, transcription; email, phone and domain checks; UK, Irish and Polish company lookups and UK risk reports; website contacts, tech stack and SEO audits; PageSpeed; AI review, job post and row enrichment; data cleaning, joins, dedupe and diffs; US and EU compliance rules. No account or API key: pay each call in USDC on Base over x402.","url":"https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"role":{"enum":["owner","service_provider"],"type":"string","description":"owner (default): the company that owns or licenses the data. service_provider: holds it for another company, which mostly means notifying that company quickly."},"sector":{"type":"array","items":{"enum":["hipaa_covered_entity","hipaa_business_associate","glba_financial","health_app","nydfs_licensee","telecom","critical_infrastructure"],"type":"string"},"description":"Sector rules that apply: hipaa_covered_entity, hipaa_business_associate, glba_financial (non-bank financial firms under the FTC Safeguards Rule), health_app (FTC Health Breach Notification Rule), nydfs_licensee (New York DFS regulated)."},"affected":{"type":"array","items":{"type":"object"},"description":"Where the affected people live: [{\"state\":\"CA\",\"count\":1200},{\"state\":\"TX\",\"count\":300},{\"country\":\"Germany\",\"count\":40},{\"country\":\"United Kingdom\",\"count\":15},{\"country\":\"Canada\",\"province\":\"Quebec\",\"count\":5}]. A bare two-letter code is read as a US state (CA = California); use {\"country\":\"CA\"} or \"Canada\" for Canada."},"encrypted":{"type":"boolean","description":"True only if all the exposed data was encrypted and the key was not exposed. Many US state laws then need no notice. Default false."},"data_types":{"type":"array","items":{"type":"string"},"description":"Personal data exposed, for example [\"ssn\",\"drivers_license\",\"payment_card\"]. If left out every law is treated as triggered (SAFE)."},"sec_registrant":{"type":"boolean","description":"True for a company that files reports with the US SEC (listed in the US). Adds Form 8-K Item 1.05."},"date_discovered":{"type":"string","description":"Date the breach was discovered (or you became aware of it), YYYY-MM-DD. Defaults to today. Deadlines are counted from it."},"materiality_date":{"type":"string","description":"SEC registrants: date the company decided the incident is material, YYYY-MM-DD. The 8-K is due 4 business days after it."}}},"responseSchema":{"type":"json","example":{"verdict":"4 notices owed under 2 laws. First fixed deadline: 2026-10-23 (The competent national data protection authority (lead authority for cross-bo...","disclaimer":"Information, not legal advice. Built from primary government sources (linked per figure); check the source before acting on a close call.","notices_owed":[{"id":"EU-GDPR","how":"Each national authority's own breach form","law":"European Union and EEA (GDPR)","note":"Read on EUR-Lex. Every breach must be documented, reported or not (Art. 33(5)). Pending change: the European Commission's Digital Omnibus pr...","notify":"The competent national data protection authority (lead authority for cross-border processing)","source":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679","citation":"Regulation (EU) 2016/679, Articles 33 and 34","depends_on":["Risk of harm test: Authority notice is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. Individuals..."],"notice_type":"data_protection_authority","affected_here":40,"deadline_date":"2026-10-23","deadline_note":"72 hours from becoming aware: the date shown assumes discovery at the start of 2026-10-20; count the hours from the actual time.","deadline_rule":"Without undue delay and, where feasible, no later than 72 hours after becoming aware. If later, give reasons for the delay. Information may...","content_required":["Nature of the breach, with categories and approximate numbers of people and records"],"matched_data_types":["ssn"],"verified_on_primary_source":true}],"_example_note":"Real output, trimmed: long lists cut to their first items and long text shortened.","date_discovered":"2026-10-20"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-1piUVdRHH4ti9pHauvPV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Calculates every data breach notification obligation a company owes across US states and international jurisdictions, including deadlines and official sources.","exampleAgentPrompt":"We just discovered a data breach on 2025-01-15 that exposed SSNs and payment card data for 3,200 California residents and 800 Texas residents — we're a GLBA-regulated financial firm and an SEC registrant. Can you calculate every breach notification obligation we owe, with deadlines and the official sources?","exampleUseCases":[{"title":"HIPAA breach notification for health app","prompt":"We're a HIPAA covered entity and discovered a breach on 2025-02-01 affecting 5,000 people in New York and 2,000 in Florida — the exposed data includes medical records and SSNs, and nothing was encrypted. What breach notifications do we owe, who do we notify, and what are the deadlines?"},{"title":"Multi-jurisdiction breach after EU and UK exposure","prompt":"We had a data breach discovered on 2025-03-10 affecting 1,500 people in Germany, 300 in the UK, and 200 in Canada — exposed data includes email addresses and payment card numbers, not encrypted. What breach notification obligations do we owe to EU, UK, and Canadian regulators, and when are the deadlines?"},{"title":"SEC 8-K filing obligation after ransomware incident","prompt":"We're an SEC-registered company and determined our ransomware incident was material on 2025-04-05 — the breach was discovered on 2025-03-28 and affected 10,000 people in various US states with SSNs exposed. Do we owe an SEC 8-K filing, and what other breach notifications are required with their deadlines?"}],"resultDescription":"A structured JSON response listing every notice owed — including the regulator or authority to notify (attorneys general, HHS, SEC, FTC, EU/UK data protection authorities, Canadian and Australian regulators), the legal citation, a dated deadline where law fixes one, the official source URL, content requirements per notice, and a plain-language disclaimer that this is information, not legal advice.","failureModes":["Missing required affected array may cause incomplete or overly conservative notice list","Invalid date format for date_discovered causes parsing errors","Ambiguous country codes (e.g. 'CA') may be misread as California instead of Canada","Incomplete data_types array defaults to treating all laws as triggered (safe but may overstate obligations)","Deadlines for non-fixed-deadline jurisdictions are omitted or noted as variable","Service may not reflect very recent legislative changes to state breach notification laws"],"whenToPreferThis":"Use this endpoint when you need a fast, comprehensive, multi-jurisdiction breach notification checklist with deadline dates and official citations — especially for incidents spanning multiple US states and/or international jurisdictions. It is purpose-built for this compliance computation and handles HIPAA, GLBA, NYDFS, SEC, GDPR, UK GDPR, Canadian, and Australian rules in a single call, which no general legal search tool does natively.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T12:41:35.820Z","isFirstParty":false,"canonicalSlug":"nero-labs-breach-notification-rules-engine-c2bd76ed"}