← The evidence ledger
Evidence row 124892
Observed , by baseline/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 39c9341b109eb2097f0bb853fd2ae5de3777292eba79324da9f9ff0cf992bbb2
- Leaf
- 0x48d6c277e78224932fe0f86a3e642a5cb403492af2c6bc87c40d7bc646cb138b
What was observed
{
"endpoints": [
[
"x402",
"https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification"
]
],
"name": "Nero Labs Agent Tools",
"owner_address": "0xa969a3127dcc74b2989a4b4e45ae61b81093164a",
"raw": {
"accepts": [
{
"amount": "3000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:8453",
"payTo": "0xA969a3127DcC74B2989a4b4e45Ae61B81093164A",
"scheme": "exact"
}
],
"description": "Works out every data breach notice a company owes and the deadline for each. Send how many people were affected per US state or country, the data types exposed, whether it was encrypted, the discovery date and flags (SEC registrant, HIPAA, GLBA, NYDFS). Returns each notice owed (people, attorneys general, credit bureaus, HHS, SEC 8-K, FTC, EU and UK regulators, Canada, Australia) with a dated deadline where the law fixes one and the official source. Not legal advice.",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"affected": [
{
"count": 1200,
"state": "CA"
},
{
"count": 40,
"country": "Germany"
}
],
"data_types": [
"ssn",
"email_address"
],
"date_discovered": "2026-10-20"
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"example": {
"_example_note": "Real output, trimmed: long lists cut to their first items and long text shortened.",
"date_discovered": "2026-10-20",
"disclaimer": "Information, not legal advice. Built from primary government sources (linked per figure); check the source before acting on a close call.",
"notices_owed": [
{
"affected_here": 40,
"citation": "Regulation (EU) 2016/679, Articles 33 and 34",
"content_required": [
"Nature of the breach, with categories and approximate numbers of people and records"
],
"deadline_date": "2026-10-23",
"deadline_note": "72 hours from becoming aware: the date shown assumes discovery at the start of 2026-10-20; count the hours from the actual time.",
"deadline_rule": "Without undue delay and, where feasible, no later than 72 hours after becoming aware. If later, give reasons for the delay. Information may...",
"depends_on": [
"Risk of harm test: Authority notice is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. Individuals..."
],
"how": "Each national authority's own breach form",
"id": "EU-GDPR",
"law": "European Union and EEA (GDPR)",
"matched_data_types": [
"ssn"
],
"note": "Read on EUR-Lex. Every breach must be documented, reported or not (Art. 33(5)). Pending change: the European Commission's Digital Omnibus pr...",
"notice_type": "data_protection_authority",
"notify": "The competent national data protection authority (lead authority for cross-border processing)",
"source": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
"verified_on_primary_source": true
}
],
"verdict": "4 notices owed under 2 laws. First fixed deadline: 2026-10-23 (The competent national data protection authority (lead authority for cross-bo..."
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"affected": {
"description": "Where the affected people live: [{\"state\":\"CA\",\"count\":1200},{\"state\":\"TX\",\"count\":300},{\"country\":\"Germany\",\"count\":40},{\"country\":\"United Kingdom\",\"count\":15},{\"country\":\"Canada\",\"province\":\"Quebec\",\"count\":5}]. A bare two-letter code is read as a US state (CA = California); use {\"country\":\"CA\"} or \"Canada\" for Canada.",
"items": {
"type": "object"
},
"type": "array"
},
"data_types": {
"description": "Personal data exposed, for example [\"ssn\",\"drivers_license\",\"payment_card\"]. If left out every law is treated as triggered (SAFE).",
"items": {
"type": "string"
},
"type": "array"
},
"date_discovered": {
"description": "Date the breach was discovered (or you became aware of it), YYYY-MM-DD. Defaults to today. Deadlines are counted from it.",
"type": "string"
},
"encrypted": {
"description": "True only if all the exposed data was encrypted and the key was not exposed. Many US state laws then need no notice. Default false.",
"type": "boolean"
},
"materiality_date": {
"description": "SEC registrants: date the company decided the incident is material, YYYY-MM-DD. The 8-K is due 4 business days after it.",
"type": "string"
},
"role": {
"description": "owner (default): the company that owns or licenses the data. service_provider: holds it for another company, which mostly means notifying that company quickly.",
"enum": [
"owner",
"service_provider"
],
"type": "string"
},
"sec_registrant": {
"description": "True for a company that files reports with the US SEC (listed in the US). Adds Form 8-K Item 1.05.",
"type": "boolean"
},
"sector": {
"description": "Sector rules that apply: hipaa_covered_entity, hipaa_business_associate, glba_financial (non-bank financial firms under the FTC Safeguards Rule), health_app (FTC Health Breach Notification Rule), nydfs_licensee (New York DFS regulated).",
"items": {
"enum": [
"hipaa_covered_entity",
"hipaa_business_associate",
"glba_financial",
"health_app",
"nydfs_licensee",
"telecom",
"critical_infrastructure"
],
"type": "string"
},
"type": "array"
}
},
"required": [
"affected"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"_example_note": {
"type": "string"
},
"also_check": {
"items": {
"type": "string"
},
"type": "array"
},
"data_as_of": {
"type": "string"
},
"date_discovered": {
"type": "string"
},
"disclaimer": {
"type": "string"
},
"from": {
"type": "string"
},
"notices_owed": {
"items": {
"properties": {
"affected_here": {
"type": "number"
},
"citation": {
"type": "string"
},
"content_required": {
"type": "array"
},
"deadline_date": {},
"deadline_note": {
"type": "string"
},
"deadline_rule": {
"type": "string"
},
"depends_on": {
"type": "array"
},
"how": {
"type": "string"
},
"id": {
"type": "string"
},
"law": {
"type": "string"
},
"matched_data_types": {
"type": "array"
},
"note": {
"type": "string"
},
"notice_type": {
"type": "string"
},
"notify": {
"type": "string"
},
"source": {
"type": "string"
},
"submit_url": {
"type": "string"
},
"verified_on_primary_source": {
"type": "boolean"
}
},
"type": "object"
},
"type": "array"
},
"related_rules_servers": {
"items": {
"properties": {
"covers": {
"type": "string"
},
"name": {
"type": "string"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"verdict": {
"type": "string"
},
"without_unreasonable_delay": {
"type": "string"
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1792616069/bazaar-icons/0a5b056fde952fc0.png",
"lastUpdated": "2026-10-21T21:29:53.518Z",
"quality": {
"l30DaysTotalCalls": 4,
"l30DaysUniquePayers": 3,
"lastCalledAt": "2026-10-21T21:29:53.298Z"
},
"resource": "https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification",
"serviceName": "Nero Labs Agent Tools",
"tags": [
"data breach",
"notification",
"privacy",
"gdpr",
"hipaa"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Works out every data breach notice a company owes and the deadline for each. Send how many people were affected per US state or country, the data types exposed, whether it was encrypted, the discovery date and flags (SEC registrant, HIPAA, GLBA, NYDFS). Returns each notice owed (people, attorneys general, credit bureaus, HHS, SEC 8-K, FTC, EU and UK regulators, Canada, Australia) with a dated deadline where the law fixes one and the official source. Not legal advice."
}What the leaf hashes
{"body":"39c9341b109eb2097f0bb853fd2ae5de3777292eba79324da9f9ff0cf992bbb2","id":124892,"kind":"listing","method":"baseline/1","observed_us":1793025625407105,"prev":null,"subject":"x402_bazaar:https://x402-agent-tools.nerolabs.workers.dev/rules/breach-notification","subject_kind":"source_record"}Proof
Its day has not closed yet. A day closes ten minutes after midnight UTC; the proof appears here then.