Note:

Information related to businesses, such as name and address, is considered public information because it’s available to the public from other sources. This type of information does not meet the definition of PII when it is not linked or linkable to an individual; however, personal information disclosed on the officers of a corporation, partners in a partnership, sole proprietor, etc., is PII. For example, if the PII of corporate officers, partners in a partnership, sole proprietors, etc., were inadvertently disclosed and the risk assessment merited a response, services as such as identity protection/identity monitoring would be offered to the individual as opposed to the business.

The IRS, through PGLD/IM, will notify potentially impacted individuals and businesses if one of the following conditions occurs:

The evaluation of an IRS data breach results in a likelihood of harm to the potentially impacted individuals or businesses. See IRM 10.5.4.4.4, PGLD/Incident Management Risk Assessment and Mitigation, and Exhibit 10.5.4-1, Glossary of Incident Management Terms, Definitions, and Acronyms, for additional information about, and examples of, harm/risk of harm.

Personal information was intentionally accessed or disclosed without authorization if the access or disclosure results in an administrative proposal of disciplinary or adverse action against an IRS employee but not criminal indictment.

The IRS, through PGLD/IM, will notify potentially impacted individuals and businesses of an IRS data breach, or an intentional unauthorized access or disclosure (UNAX/UNAD) resulting in proposed disciplinary or adverse action against an employee, via Letter 4281C, IM Breach Notification Letter.