Works out every data breach notice a company owes and the deadline for each

Works out every data breach notice a company owes and the deadline for each. Send how many people were affected per US state or country, the data types exposed, whether it was encrypted, the discovery date and flags (SEC registrant, HIPAA, GLBA, NYDFS). Returns each notice owed (people, attorneys general, credit bureaus, HHS, SEC 8-K, FTC, EU and UK regulators, Canada, Australia) with a dated deadline where the law fixes one and the official source. Not legal advice.

Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.

Endpoint

POST https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification

Our checks, last 30 days

We never call tools that send, buy, move money or file anything, not even without paying.

Example input (from the provider)

{
  "body": {
    "affected": [
      {
        "count": 1200,
        "state": "CA"
      },
      {
        "count": 40,
        "country": "Germany"
      }
    ],
    "data_types": [
      "ssn",
      "email_address"
    ],
    "date_discovered": "2026-10-20"
  },
  "bodyType": "json",
  "method": "POST",
  "type": "http"
}

Promised output schema (from the provider)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "body": {
          "additionalProperties": false,
          "properties": {
            "affected": {
              "description": "Where the affected people live: [{\"state\":\"CA\",\"count\":1200},{\"state\":\"TX\",\"count\":300},{\"country\":\"Germany\",\"count\":40},{\"country\":\"United Kingdom\",\"count\":15},{\"country\":\"Canada\",\"province\":\"Quebec\",\"count\":5}]. A bare two-letter code is read as a US state (CA = California); use {\"country\":\"CA\"} or \"Canada\" for Canada.",
              "items": {
                "type": "object"
              },
              "type": "array"
            },
            "data_types": {
              "description": "Personal data exposed, for example [\"ssn\",\"drivers_license\",\"payment_card\"]. If left out every law is treated as triggered (SAFE).",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "date_discovered": {
              "description": "Date the breach was discovered (or you became aware of it), YYYY-MM-DD. Defaults to today. Deadlines are counted from it.",
              "type": "string"
            },
            "encrypted": {
              "description": "True only if all the exposed data was encrypted and the key was not exposed. Many US state laws then need no notice. Default false.",
              "type": "boolean"
            },
            "materiality_date": {
              "description": "SEC registrants: date the company decided the incident is material, YYYY-MM-DD. The 8-K is due 4 business days after it.",
              "type": "string"
            },
            "role": {
              "description": "owner (default): the company that owns or licenses the data. service_provider: holds it for another company, which mostly means notifying that company quickly.",
              "enum": [
                "owner",
                "service_provider"
              ],
              "type": "string"
            },
            "sec_registrant": {
              "description": "True for a company that files reports with the US SEC (listed in the US). Adds Form 8-K Item 1.05.",
              "type": "boolean"
            },
            "sector": {
              "description": "Sector rules that apply: hipaa_covered_entity, hipaa_business_associate, glba_financial (non-bank financial firms under the FTC Safeguards Rule), health_app (FTC Health Breach Notification Rule), nydfs_licensee (New York DFS regulated).",
              "items": {
                "enum": [
                  "hipaa_covered_entity",
                  "hipaa_business_associate",
                  "glba_financial",
                  "health_app",
                  "nydfs_licensee",
                  "telecom",
                  "critical_infrastructure"
                ],
                "type": "string"
              },
              "type": "array"
            }
          },
          "required": [
            "affected"
          ],
          "type": "object"
        },
        "bodyType": {
          "enum": [
            "json",
            "form-data",
            "text"
          ],
          "type": "string"
        },
        "method": {
          "enum": [
            "POST"
          ],
          "type": "string"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method",
        "bodyType",
        "body"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "type": "object"
        },
        "type": {
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}

This page as JSON