breach_notification

Instructions

Args:
    breach_description: Description of the personal data breach
    data_categories_affected: Types of personal data affected
    number_of_records: Approximate number of records/individuals affected
    breach_type: Type of breach: "confidentiality" (unauthorized access), "integrity" (unauthorized alteration), "availability" (unauthorized loss of access)
    detection_timestamp: When the breach was detected (ISO format, or "now")
    ai_system_involved: Whether an AI system was involved in the breach
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Implementation Reference

• server.py:869-1021 (handler)

  The main tool handler function for 'breach_notification'. Assesses breach severity under GDPR Articles 33-34 (72-hour rule), determines supervisory authority and data subject notification requirements, and generates notification content.

  @mcp.tool()
  def breach_notification(
      breach_description: str,
      data_categories_affected: list[str],
      number_of_records: int = 0,
      breach_type: str = "confidentiality",
      detection_timestamp: str = "",
      ai_system_involved: bool = False,
      caller: str = "anonymous",
      tier: str = "free", api_key: str = "") -> str:
      """Assess breach severity and notification requirements under GDPR Articles
      33-34 (72-hour rule). Determines whether supervisory authority and data
      subject notification is required, and generates the notification content.
  
      Args:
          breach_description: Description of the personal data breach
          data_categories_affected: Types of personal data affected
          number_of_records: Approximate number of records/individuals affected
          breach_type: Type of breach: "confidentiality" (unauthorized access), "integrity" (unauthorized alteration), "availability" (unauthorized loss of access)
          detection_timestamp: When the breach was detected (ISO format, or "now")
          ai_system_involved: Whether an AI system was involved in the breach
          caller: Caller identifier for rate limiting
          tier: Access tier (free/pro)
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return {"error": msg, "upgrade_url": "https://meok.ai/pricing"}
      if err := _check_rate_limit(caller, tier):
          return {"error": err}
  
      if detection_timestamp and detection_timestamp != "now":
          try:
              detected = datetime.fromisoformat(detection_timestamp)
          except ValueError:
              detected = datetime.now(timezone.utc)
      else:
          detected = datetime.now(timezone.utc)
  
      deadline = detected + timedelta(hours=72)
  
      # Severity assessment
      special_categories = {"biometric", "health", "genetic", "financial", "criminal", "password", "credential"}
      has_special = any(any(sc in d.lower() for sc in special_categories) for d in data_categories_affected)
  
      severity_score = 0
      if has_special:
          severity_score += 3
      if number_of_records > 100000:
          severity_score += 3
      elif number_of_records > 10000:
          severity_score += 2
      elif number_of_records > 100:
          severity_score += 1
      if breach_type == "confidentiality":
          severity_score += 2
      elif breach_type == "integrity":
          severity_score += 2
      else:
          severity_score += 1
      if ai_system_involved:
          severity_score += 1
  
      if severity_score >= 7:
          severity = "CRITICAL"
          risk_to_rights = "high"
      elif severity_score >= 5:
          severity = "HIGH"
          risk_to_rights = "high"
      elif severity_score >= 3:
          severity = "MEDIUM"
          risk_to_rights = "some"
      else:
          severity = "LOW"
          risk_to_rights = "unlikely"
  
      notify_authority = risk_to_rights != "unlikely"
      notify_data_subjects = risk_to_rights == "high"
  
      result = {
          "assessment_type": "GDPR Breach Notification Assessment",
          "timestamp": datetime.now(timezone.utc).isoformat(),
          "breach": {
              "description": breach_description,
              "data_categories": data_categories_affected,
              "records_affected": number_of_records,
              "breach_type": breach_type,
              "detection_time": detected.isoformat(),
              "ai_involved": ai_system_involved,
          },
          "severity_assessment": {
              "severity": severity,
              "severity_score": severity_score,
              "risk_to_rights_and_freedoms": risk_to_rights,
              "special_categories_affected": has_special,
          },
          "notification_requirements": {
              "notify_supervisory_authority": {
                  "required": notify_authority,
                  "article": "Article 33",
                  "deadline": deadline.isoformat(),
                  "deadline_human": "72 hours from awareness of breach",
                  "content_required": [
                      "Nature of the breach including categories and approximate number of data subjects",
                      "Name and contact details of DPO or other contact point",
                      "Likely consequences of the breach",
                      "Measures taken or proposed to address the breach and mitigate effects",
                  ],
              },
              "notify_data_subjects": {
                  "required": notify_data_subjects,
                  "article": "Article 34",
                  "condition": "When breach is likely to result in HIGH risk to rights and freedoms",
                  "deadline": "Without undue delay",
                  "content_required": [
                      "Nature of the breach in clear and plain language",
                      "Name and contact details of DPO",
                      "Likely consequences of the breach",
                      "Measures taken or proposed to address the breach",
                  ],
                  "exceptions": [
                      "Data was encrypted/unintelligible to unauthorized persons",
                      "Subsequent measures ensure high risk is no longer likely",
                      "Disproportionate effort — public communication may substitute",
                  ],
              },
          },
          "ai_specific": (
              {
                  "ai_breach_considerations": [
                      "Assess whether model was compromised (poisoned, extracted, or manipulated)",
                      "Check for training data leakage through model memorization",
                      "Evaluate adversarial attack vectors that caused the breach",
                      "Consider model rollback to pre-breach checkpoint",
                      "Report under EU AI Act Article 62 (serious incident) if applicable",
                  ],
              }
              if ai_system_involved
              else None
          ),
          "immediate_actions": [
              "Contain the breach — stop unauthorized access/processing",
              "Preserve evidence for investigation",
              "Assess scope and impact",
              "Activate breach response team",
              f"Notify supervisory authority by {deadline.strftime('%Y-%m-%d %H:%M UTC')}" if notify_authority else "Document decision not to notify with rationale",
              "Notify affected data subjects without undue delay" if notify_data_subjects else None,
              "Update breach register (Art.33(5))",
          ],
      }
  
      result["immediate_actions"] = [a for a in result["immediate_actions"] if a]
  
      return result