Means of Providing Data Breach Notifications

The IRS will provide written notification to the individual's (or business’) address of record on IDRS.

Based on the number of potentially impacted individuals (or businesses) and the urgency with which they may need to receive notice, the IRS may supplement written notification with other means of communication such as newspapers or other media outlets.

For high-risk data breaches, at the discretion of the BRT, and consistent with applicable law, the IRS may notify external entities. In making its decision, the BRT will consider whether notifying external entities would result in any of the following:

Aiding the public in its response to the data breach (e.g., whether constructive notification via media channels would help the IRS alert potentially impacted individuals more effectively and expeditiously than via notification letter alone)

Facilitating the IRS’ ability to mitigate the potential harm resulting from the data breach (e.g., preparing counterpart entities such as the Federal Trade Commission (FTC) that may receive a surge in inquiries)

Contributing to unnecessary public alarm

Creating an unnecessary burden on the public, external entities, or potentially impacted individuals (or businesses)