Methodology & sources
How the rules are compiled, verified, and kept current, and where a licensed attorney's judgment still governs.
Primary law, not paraphrase
Every rule is compiled from the primary statute, the state code section that governs. Law-firm 50-state charts (Perkins Coie, Foley & Lardner, IAPP, Mintz, Davis Wright Tremaine) are used only as finding aids and cross-checks; we never reproduce their text or arrangement. Facts like deadlines and thresholds are not copyrightable, but a chart's expression is, so we cite the statute we independently verified.
The engine is deterministic
No language model determines your obligations, computes a deadline, or picks a threshold. That logic runs on versioned, testable rules with a suite of golden fixtures asserting the right answer for scenarios like California's post-SB-446 clock, Maryland's notify-the-AG-first sequencing, and Massachusetts's prohibition on describing the breach. A model is used only to smooth prose between rule-locked clauses in letter drafts, and every draft is then checked by deterministic validators.
Confidence, shown honestly
Each jurisdiction carries a confidence tier and a last-verified date, surfaced everywhere it's used.
| high | 10 jurisdictions | Charts agree and the primary statute was spot-checked, including the 2026 amendments. |
| med | 44 jurisdictions | Multiple sources agree; full statute pass pending attorney review. |
| low | 0 jurisdiction | Thin or conflicting data, flagged, never guessed. |
Kept current
State legislatures are monitored through LegiScan and a set of privacy-law feeds, with a quarterly manual diff against the published charts. When a rule changes, we publish it to the changelog with a target of reflecting any effective change within seven days. This build reflects the July 2026 landscape, including California SB 446 and Oklahoma SB 626.
Where your judgment governs
Roughly half the states use a risk-of-harm standard: whether notice is required is a legal judgment, not a calculation. BreachCompass flags those as judgment calls, quotes the statutory standard, and records the determination you make, it does not make it for you. That is the line between decision support and legal advice, and we hold it deliberately.