A specific model is being recommended to businesses. To give you an example, you have to indicate what occurred; when the loss took place; the type of personal information involved; a fairly precise summary indicating the risk of fraud; advice to individuals as to how to better protect themselves; steps the company needs to take; people who can provide any further assistance; the challenges associated with getting this information out to people, by mail, for instance, given the problem of junk mail with e-mailing, for example.
On February 22nd, 2007. See this statement in context.