Breach notices
How to check whether a notice was given
Short answer
- California breach notices
- Searchable list of notices submitted to and published by the Attorney General 1
- US health data breaches
- HHS Office for Civil Rights Breach Portal 2
- US listed company filings
- EDGAR full text search, filings since 2001 4
- FDA warning letters
- Filterable list with posted date and close-out status 6
- FCA notices
- Decision notices published when the FCA decides to act 7
- California WARN notices
- Latest WARN report and annual reports from the EDD 9
Start with the rule, then the register
First work out which rule applied and who the notice had to go to. Some notices go to a regulator that publishes them. Others go only to the people affected, and no public copy exists.
A register shows what the regulator chose or was required to publish. It may not show every notice, and it may not show what happened next. The FDA notes that matters described in its warning letters may have been the subject of later interaction with the agency 6.
Data breach notices
In California, a business that notifies more than 500 residents about one breach must send a sample copy of the notice to the Attorney General 1. The Attorney General's office lets the public search data security breaches submitted to and published by it 1. Residents can file a complaint through the office's online form 1.
For US health data, HIPAA covered entities must tell the HHS Secretary about breaches affecting 500 or more people within 60 days, and smaller breaches within 60 days after the end of the calendar year 3. The HHS Office for Civil Rights says it investigates all breaches of protected health information that affect 500 or more individuals 2. Its portal links to HIPAA breach reports and 42 CFR Part 2 breach reports 2.
For listed US companies, a material cybersecurity incident is disclosed under Item 1.05 of Form 8-K 5. EDGAR full text search covers electronic filings since 2001 and can be narrowed by form 4.
Regulatory notices
The FDA Warning Letters page can be filtered by issuing office, letter issue date, posted date, year and whether a response or close-out letter exists 6. Results can be downloaded 6.
The UK FCA says decision notices are issued and published when it decides to take action, and final notices are issued when it takes action 7. It may publish some details of a warning notice in a statement 7. A published warning notice statement describes proposed action, not a final decision 7.
The FCA Warning List is a separate check. It lists unauthorised firms and individuals, including clones 8. The FCA says a firm missing from the list may still be unauthorised or a scam 8.
Layoff and recall notices
California's Employment Development Department publishes its latest WARN report as a spreadsheet and annual WARN reports from 1 July 2014 to 30 June 2026 9.
The CPSC recall list can be searched by date, hazard, category and country of manufacture, and downloaded as CSV 10. The CPSC says its data updates weekly as new recalls are announced 10.
Quick reference
| What you are checking | Where to look |
|---|---|
| Breach notice to California residents | California Attorney General breach search 1 |
| US health data breach | HHS OCR Breach Portal 2 |
| Material cyber incident at a US listed company | EDGAR full text search 4 |
| FDA warning letter | FDA Warning Letters page 6 |
| FCA enforcement notice | FCA enforcement pages 7 |
| Unauthorised firm in the UK | FCA Warning List 8 |
| California layoff notice | EDD WARN reports 9 |
| US consumer product recall | CPSC recalls list 10 |
Common questions
Is there a public list of data breach notices?
Some regulators publish one. The California Attorney General lists breach notices submitted to and published by its office 1.
How can I find an SEC cybersecurity incident filing?
Search EDGAR full text search, which covers filings since 2001 and can be filtered by form 4.
Is a published FCA warning notice statement a final finding?
No. The FCA says a warning notice is not its final decision 7.
If a firm is not on the FCA Warning List, is it safe?
Not necessarily. The FCA says a firm not on the list may still be unauthorised or a scam 8.
Where are California WARN notices published?
On the EDD WARN page, as the latest report and annual reports 9.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.
Sources
- State of California Department of Justice: Data Security Breach Reporting
- HHS Office for Civil Rights: Breach Portal
- HHS: Breach Notification Rule
- SEC: EDGAR Full Text Search
- SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (26 July 2023)
- FDA: Warning Letters (content current as of 4 November 2026)
- FCA: Enforcement
- FCA: FCA Warning List of unauthorised firms
- California EDD: Worker Adjustment and Retraining Notification (WARN)
- CPSC: Recalls & Product Safety Warnings
Related
- Data breach notification laws compared
How breach notice rules differ in the EU, UK, US, Australia, Canada and India: who must notify, the deadline and who receives the notice.
- Product recall notices compared
How recall notices work at the US CPSC, FDA and NHTSA, UK OPSS, EU Safety Gate, Australia's ACCC and Health Canada, and where each list is published.
- FDA warning letters explained
What an FDA warning letter is, how it differs from a Form 483 and an untitled letter, response times, close-out letters and where letters are posted.
- FCA warning notices and decision notices explained
How UK FCA warning, decision and final notices work, the Regulatory Decisions Committee, the Upper Tribunal and the FCA Warning List.
- WARN Act layoff notices explained
How US WARN Act layoff notices work: 60 days, who is covered, who gets the notice, exceptions and penalties, plus California WARN, UK HR1 and Canada rules.
- What a formal notice is
What makes a notice formal: who gives it, who receives it, the deadline and the form. Breach, recall, regulatory, layoff and court notices compared.