DeclareBreachSubjectDto

subjectTypestringrequired

Possible values: [client, agent, user]

subjectIdstringrequired

dataCategoriesstring[]required

Complaints + SARs Phase 2 gap 4 — DPPA §17 severity assessment. Every subject on a breach declaration must enumerate WHICH data categories were exposed. Downstream severity classification + regulator notification cadence (72h if NIN / bank_account / medical vs 30d otherwise) key off this list.

Possible values: [nin, phone, email, address, bank_account, medical, financial, behavioural, other]

DeclareBreachSubjectDto

{
  "subjectType": "client",
  "subjectId": "string",
  "dataCategories": [
    "nin"
  ]
}