; or (2) the result of which the head of an agency determines that notifying potentially affected individuals is necessary pursuant to subsection (b)(1), regardless of whether— (A) the number of potentially affected individuals is less than 50,000; or (B) the notification is delayed under subsection (d). (b) Notification As expeditiously as practicable and without unreasonable delay, and in any case not later than 45 days after an agency has a reasonable basis to conclude that a breach has occurred, the head of the agency, in consultation with the Chief Information Officer and Chief Privacy Officer of the agency, shall— (1) determine whether notice to any individual potentially affected by the breach is appropriate, including by conducting an assessment of the risk of harm to the individual that considers— (A) the nature and sensitivity of the personally identifiable information affected by the breach; (B) the likelihood of access to and use of the personally identifiable information affected by the breach; (C) the type of breach; and (D) any other factors determined by the Director; and (2) if the head of the agency determines notification is necessary pursuant to paragraph (1), provide written notification in accordance with subsection (c) to each individual potentially affected by the breach— (A) to the last known mailing address of the individual; or (B) through an appropriate alternative method of notification. (c) Contents of notification Each notification of a breach provided to an individual under subsection (b)(2) shall include, to the maximum extent practicable— (1) a brief description of the breach; (2) if possible, a description of the types of personally identifiable information affected by the breach; (3) contact information of the agency that may be used to ask questions of the agency, which— (A) shall include an e-mail address or another digital contact mechanism; and (B) may include a telephone number, mailing address, or a website; (4) information on any remedy being offered by the agency