--- title: "47 CFR 64.2011 CPNI: Notification of customer proprietary network information security breaches" canonical: "https://dposchool.com/cpni/section/64.2011" source: "https://www.ecfr.gov/current/title-47/section-64.2011" source_note: "Source: United States Code, title 47, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 47 CFR 64.2011 CPNI · Subpart U: Privacy of Customer Information # 47 CFR 64.2011 CPNI: Notification of customer proprietary network information security breaches eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text Link to an amendment published at 89 FR 10002, Feb. 12, 2024. ### 47 CFR 64.2011(a) **(a)** A telecommunications carrier shall notify law enforcement of a breach of its customers' CPNI as provided in this section. The carrier shall not notify its customers or disclose the breach publicly, whether voluntarily or under state or local law or these rules, until it has completed the process of notifying law enforcement pursuant to paragraph (b) of this section. ### 47 CFR 64.2011(b) **(b)** As soon as practicable, and in no event later than seven (7) business days, after reasonable determination of the breach, the telecommunications carrier shall electronically notify the United States Secret Service (USSS) and the Federal Bureau of Investigation (FBI) through a central reporting facility. The Commission will maintain a link to the reporting facility at http://www.fcc.gov/eb/cpni. #### 47 CFR 64.2011(b)(1) **(1)** Notwithstanding any state law to the contrary, the carrier shall not notify customers or disclose the breach to the public until 7 full business days have passed after notification to the USSS and the FBI except as provided in paragraphs (b)(2) and (b)(3) of this section. #### 47 CFR 64.2011(b)(2) **(2)** If the carrier believes that there is an extraordinarily urgent need to notify any class of affected customers sooner than otherwise allowed under paragraph (b)(1) of this section, in order to avoid immediate and irreparable harm, it shall so indicate in its notification and may proceed to immediately notify its affected customers only after consultation with the relevant investigating agency. The carrier shall cooperate with the relevant investigating agency's request to minimize any adverse effects of such customer notification. #### 47 CFR 64.2011(b)(3) **(3)** If the relevant investigating agency determines that public disclosure or notice to customers would impede or compromise an ongoing or potential criminal investigation or national security, such agency may direct the carrier not to so disclose or notify for an initial period of up to 30 days. Such period may be extended by the agency as reasonably necessary in the judgment of the agency. If such direction is given, the agency shall notify the carrier when it appears that public disclosure or notice to affected customers will no longer impede or compromise a criminal investigation or national security. The agency shall provide in writing its initial direction to the carrier, any subsequent extension, and any notification that notice will no longer impede or compromise a criminal investigation or national security and such writings shall be contemporaneously logged on the same reporting facility that contains records of notifications filed by carriers. ### 47 CFR 64.2011(c) **(c)** Customer notification. After a telecommunications carrier has completed the process of notifying law enforcement pursuant to paragraph (b) of this section, it shall notify its customers of a breach of those customers' CPNI. ### 47 CFR 64.2011(d) **(d)** Recordkeeping. All carriers shall maintain a record, electronically or in some other manner, of any breaches discovered, notifications made to the USSS and the FBI pursuant to paragraph (b) of this section, and notifications made to customers. The record must include, if available, dates of discovery and notification, a detailed description of the CPNI that was the subject of the breach, and the circumstances of the breach. Carriers shall retain the record for a minimum of 2 years. ### 47 CFR 64.2011(e) **(e)** Definitions. As used in this section, a “breach” has occurred when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI. ### 47 CFR 64.2011(f) **(f)** This section does not supersede any statute, regulation, order, or interpretation in any State, except to the extent that such statute, regulation, order, or interpretation is inconsistent with the provisions of this section, and then only to the extent of the inconsistency. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [47 CFR 64.2011 on eCFR](https://www.ecfr.gov/current/title-47/section-64.2011) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [CPNI Navigator](https://dposchool.com/cpni) / 47 CFR 64.2011 Previous: [47 CFR 64.2010 CPNI: Safeguards on the disclosure of customer proprietary network information](https://dposchool.com/cpni/section/64.2010) ## For AI agents - Machine-readable index: https://dposchool.com/cpni/llms.txt - JSON API: https://dposchool.com/cpni/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents