- One incident can trigger duties to a data protection regulator, a cyber security or sector regulator, a securities regulator and your customers under contract, each on a different clock
- Most clocks start when you become aware of the incident, not when the investigation finishes. Several regimes expect a short first report and a fuller one later
- The shortest deadlines are six hours for CERT-In in India, four hours after classifying a major incident under DORA, and 24-hour early warnings under NIS2 and the UK's proposed Cyber Security and Resilience Bill
- The US has no single federal breach law. State laws, HIPAA and the SEC's four-business-day rule for listed companies all run separately
- Brazil gives three working days, much shorter than the 72 hours under GDPR, so a plan written only for GDPR will miss it
How notification clocks work
Three questions decide every notification duty: what starts the clock, who must be told, and how much you must know before you file.
What starts the clock. Under UK and EU GDPR the 72 hours run from when you become aware of a personal data breach. European regulators read "aware" as having a reasonable degree of certainty that a security incident has compromised personal data, which can come within hours of the first alert. HIPAA counts from discovery, including the date you would have known with reasonable diligence. The SEC rule counts from the date a listed company decides an incident is material, and that decision must itself be made without unreasonable delay. DORA counts from the moment a financial entity classifies an incident as major. Record the time and the evidence at each of these points in the decision log.
Who must be told. The regulator and the affected people usually have different thresholds. GDPR requires notice to the regulator unless the breach is unlikely to result in a risk to individuals, but notice to the individuals only when the risk is high. Some regimes add others: US state attorneys general, the media under HIPAA, or investors under the SEC rule.
How much you must know. Very little, at first. GDPR lets you provide information in phases. NIS2, DORA and the UK's proposed Cyber Security and Resilience Bill are built in stages: a short early report, a fuller notification, then a final report. Waiting for the full picture before filing is an easy way to miss the deadline.
Deadlines at a glance
Thresholds and scope vary within each regime, so treat this table as a map, then check the detail below and the official source for each one.
| Regime | Deadline | Report to |
|---|---|---|
| UK GDPR | 72 hours from awareness, where feasible | ICO; individuals if the risk is high |
| UK NIS Regulations | 72 hours from awareness | Sector competent authority, or the ICO for digital service providers |
| UK Cyber Security and Resilience Bill (proposed) | 24 hours initial notification, 72 hours full report | Sector regulator and the NCSC |
| UK FCA and PRA (from 18 March 2027) | Staged reports for incidents above set thresholds | FCA and, for dual-regulated firms, the PRA |
| EU GDPR | 72 hours from awareness, where feasible | Lead or local supervisory authority; individuals if the risk is high |
| EU NIS2 | 24 hours early warning, 72 hours notification, final report within one month | National CSIRT or competent authority |
| EU DORA | 4 hours from classification as major (no later than 24 hours from awareness), 72 hours intermediate, one month final | Financial supervisor |
| US state breach laws | Varies; 30 days in Colorado, Florida, Maine and Washington | Affected residents; often the state attorney general |
| US HIPAA | Without unreasonable delay, within 60 days of discovery | Individuals, HHS and, above 500 residents of a state, the media |
| US SEC Form 8-K Item 1.05 | Four business days from the materiality decision | Investors, by public filing |
| Brazil LGPD (Resolution CD/ANPD 15/2024) | Three working days; double for small processing agents | ANPD and affected individuals |
| Australia Notifiable Data Breaches | Assess within 30 days; notify as soon as practicable | OAIC and affected individuals |
| Australia SOCI Act | 12 hours for significant impact, 72 hours for relevant impact | ASD's Australian Cyber Security Centre |
| Australia ransomware payments | 72 hours from the payment | Australian Signals Directorate |
| India CERT-In Directions | Six hours from noticing the incident | CERT-In |
| India DPDP Rules (expected from 2027) | Without delay, detailed report within 72 hours | Data Protection Board and affected individuals |
| Canada PIPEDA | As soon as feasible | Privacy Commissioner and affected individuals |
United Kingdom
Under UK GDPR, a controller must report a personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to people's rights and freedoms, you must tell them too, without undue delay. You must also record every breach, including those you decide not to report, with the facts, the effects and what you did. The ICO's breach reporting page has the online form and a self-assessment tool.
Operators of essential services under the NIS Regulations 2018 must tell their sector's competent authority about an incident with a significant impact on the service within 72 hours of becoming aware of it. Relevant digital service providers, such as online marketplaces and cloud services, report to the ICO.
The Cyber Security and Resilience Bill would replace that with a two-stage regime: an initial notification within 24 hours of becoming aware of a significant incident and a full report within 72 hours, sent to both the regulator and the NCSC. It would also bring managed service providers and data centres into scope. Our article on the Cyber Security and Resilience Bill covers who it affects.
Financial services firms get a single operational incident and third-party reporting regime from 18 March 2027 under FCA PS26/2 and matching PRA rules, with staged reports for incidents that meet defined thresholds.
European Union
EU GDPR sets the same 72-hour rule as the UK version (Article 33), and the same high-risk test for telling individuals (Article 34). The hard part is knowing which authority to tell. If you have a main establishment in the EU (normally your central administration there, or wherever decisions about the processing are made), the supervisory authority in that member state usually leads on cross-border cases through the one-stop shop. An EU office that makes no such decisions may not count. With no establishment in the EU, the one-stop shop does not apply: the EDPB's breach notification guidelines say you must notify every supervisory authority in a member state where affected people live, and appointing an EU representative under Article 27 does not change that. The answer depends on how and where you process the data, so settle it with counsel in advance and write it into the plan.
NIS2 applies to essential and important entities in 18 sectors. Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, saying whether it looks malicious and whether it could have cross-border effects. A fuller incident notification follows within 72 hours, and a final report within one month of that notification, or a progress report if the incident is still running. Each member state names its own CSIRT or competent authority, so check the national law where you operate. Our NIS2 compliance guide covers scope.
DORA has applied to EU financial entities since 17 January 2025. Once a financial entity classifies an ICT-related incident as major, it has four hours to send the initial notification, and no more than 24 hours from first becoming aware of the incident. An intermediate report follows within 72 hours of the initial notification and a final report within one month of the latest intermediate report. The classification criteria (clients affected, duration, data loss, critical services hit) sit in the regulatory technical standards. Our article on DORA for financial services explains the wider requirements.
United States
Every US state has its own breach notification law, and the law that applies is the one where each affected person lives. Many require notice "in the most expedient time possible and without unreasonable delay"; others set a fixed limit. Colorado, Florida, Maine and Washington allow 30 days, and most of them also require notice to the state attorney general once a breach affects a set number of residents, often 500. The Washington attorney general's guidance is a clear example. Definitions of personal information also vary, and many states exempt data that was encrypted, unless the key was taken too.
Under HIPAA, covered entities must notify affected individuals without unreasonable delay and within 60 calendar days of discovery. Breaches affecting 500 or more people go to HHS in the same window, and breaches affecting more than 500 residents of one state or jurisdiction also require notice to prominent media there. Smaller breaches are logged and reported to HHS within 60 days of the end of the calendar year. Business associates must tell the covered entity within 60 days of discovery.
Companies listed in the US must disclose a material cybersecurity incident on Form 8-K, Item 1.05, within four business days of deciding that it is material. The SEC's rule says that decision must be made without unreasonable delay after discovery, and an ongoing investigation alone is no reason to put it off. The only route to delay is a determination by the US Attorney General that disclosure would pose a substantial risk to national security or public safety.
For most organisations, reporting to CISA or the FBI's IC3 is voluntary, though worth considering. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) sets 72 hours for covered incidents and 24 hours for ransom payments for critical infrastructure entities, once CISA's implementing rule takes effect; check its status for your sector, along with any sector rules from your own regulator.
Brazil
Under Resolution CD/ANPD 15/2024, a controller must notify the ANPD and the affected individuals within three working days of learning that a security incident involving personal data may cause them significant risk or harm. Small processing agents get double the time. You can send further information within 20 working days of the first notification. The controller must also keep a record of every incident, including those not reported. Notifications go through the ANPD's incident reporting service, usually filed by the encarregado (the data protection officer).
Australia
Under the Notifiable Data Breaches scheme, an organisation that suspects an eligible data breach (one likely to cause serious harm) must assess it within 30 days. Once it believes one has happened, it must notify the OAIC and the affected individuals as soon as practicable. The 30 days is a maximum, not a target.
Responsible entities for critical infrastructure assets under the Security of Critical Infrastructure Act report to ASD's Australian Cyber Security Centre within 12 hours of becoming aware of an incident with a significant impact, and within 72 hours for a relevant impact. A 12-hour report made by phone must be followed by a written one within 84 hours. Since 30 May 2025, businesses with an annual turnover of A$3 million or more, and critical infrastructure responsible entities, must report a ransomware or cyber extortion payment within 72 hours of making it or becoming aware it was made. Both go through cyber.gov.au.
India
CERT-In's Directions of 28 April 2022 require service providers, intermediaries, data centres, companies and government bodies to report listed cyber incidents within six hours of noticing them or being told about them. The list is broad and includes data breaches, ransomware, compromise of critical systems and attacks on cloud services. The same Directions require ICT system logs to be kept for a rolling 180 days within India.
The Digital Personal Data Protection Rules, notified on 13 November 2025, add a separate duty: tell the Data Protection Board and each affected person about a personal data breach without delay, then send the Board a detailed report within 72 hours. The breach provisions are expected to apply from around May 2027, 18 months after the Rules were notified.
Canada
Under PIPEDA, a private-sector organisation that has a breach creating a real risk of significant harm must report it to the Office of the Privacy Commissioner and notify the affected individuals as soon as feasible. It must keep a record of every breach of security safeguards, reportable or not, for 24 months. Quebec has its own law, which requires prompt notice to its Commission d'accès à l'information where there is a risk of serious injury.
Contracts and insurance
Law is only part of it. Data processing agreements, customer contracts and supplier contracts often set their own notice periods, sometimes 24 or 48 hours, and a missed contractual deadline can cost you the customer even if the regulator is satisfied. Cyber insurance policies usually require prompt notice to the insurer, and many require you to use the insurer's panel of responders and lawyers. Card payment incidents bring in your acquiring bank under the card scheme rules. Pull these deadlines out of the contracts now and put them in the same list as the legal ones.
If a supplier processes personal data for you, the supplier must tell you, but the duty to notify the regulator usually stays with you. Your clock runs from when you become aware. The supplier's report usually starts it, but a news story or a customer complaint can start it sooner, so record when and how you first heard.
Building a notification matrix
A notification matrix is a table in your incident response plan with one row for every regime that could apply to you. List the regimes from where you are established, where your customers and staff live, which sectors you operate in, whether you are listed, and what your contracts say. For each row, record:
- The trigger and the threshold: what kind of incident counts, and from what moment the clock runs
- Each deadline, including staged reports
- The recipient and the filing route, with the URL or portal and any account you need to set up in advance
- Who decides whether to notify, who files, and who signs off the wording
- Whether individuals must be told, and the template you will use
Here is the start of a matrix with three example rows. Copy the headings and add a row for every regime on your list.
| Regime | Trigger and threshold | Deadlines | Recipient and route | Decides / files | Tell individuals? |
|---|---|---|---|---|---|
| UK GDPR | Personal data breach likely to result in a risk to individuals; clock runs from awareness | 72 hours where feasible; further detail can follow in phases | ICO, through its online breach report form | DPO advises; incident lead decides; DPO files | Yes, without undue delay, if the risk is high |
| EU NIS2 (if in scope) | Significant incident affecting the service; clock runs from awareness | Early warning 24 hours, notification 72 hours, final report one month | National CSIRT or competent authority, through its portal, in the member state with jurisdiction over you | Incident lead decides; compliance lead files | Recipients of the service, where the incident is likely to affect them |
| Customer contract (example) | Whatever the contract defines as a security incident affecting the customer's data or service | As written in the contract; often shorter than any regulator's | The customer's named security contact | Account owner drafts; legal approves | Not applicable |
The rows are illustrations. Thresholds, deadlines and filing routes differ by regime and change over time, so check each row against the official source when you build the matrix and again at each review.
Run at least one tabletop exercise a year in which the team has to work through the matrix against the clock, and update it whenever you enter a new country or sector. Our guide to building an incident response plan shows where the matrix fits, and our article on the first 72 hours after a breach walks through the response itself.