Data Breach Notification Deadlines by Jurisdiction

After a breach, the first hard question is how long you have. The honest answer is that it depends on where the affected people are, what kind of organisation you are, and which law you fall under. Several clocks can run at once.

This page collects the data breach notification deadlines from the legal texts themselves. Each row was read on 13 Nov 2026 and links to the clause. It is a reference, not legal advice: for a live incident, take advice from a lawyer in the relevant jurisdiction.

Data breach notification deadlines at a glance

The table lists the time allowed to tell the regulator and the time allowed to tell the people affected. They are often different.

Three more regimes are covered below with caveats: New Zealand, Singapore and South Africa. Two widely quoted rules are not yet in force and have their own section.

European Union and United Kingdom

GDPR: 72 hours, to the regulator

Article 33 of the GDPR says the controller must notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it". Three details are often missed:

• The clock starts on awareness, not on the date of the breach.
• No report is needed if the breach is unlikely to result in a risk to people's rights and freedoms.
• A late report is allowed but must be "accompanied by reasons for the delay".

Individuals are a separate duty under Article 34, triggered only when the breach is likely to result in a high risk to them.

The UK kept the same wording after leaving the EU. The ICO's guide puts it as "not later than 72 hours after becoming aware of it".

One UK rule did change. Telecoms and internet service providers report under regulation 5A of PECR, which allowed 24 hours until 20 August 2025 and now allows 72.

NIS2: three reports, not one

NIS2 covers "essential" and "important" entities in sectors such as energy, health, digital infrastructure and managed IT services. Article 23 sets a sequence:

1. Early warning within 24 hours of becoming aware of a significant incident.
2. Incident notification within 72 hours, with an initial assessment.
3. Final report within one month of the notification.

NIS2 is a directive, so each member state writes it into national law, and details vary by country. What counts as "significant" for digital providers is defined in Implementing Regulation 2024/2690. For a managed service provider, one test is that the service "is completely unavailable for more than 30 minutes".

DORA: four hours for financial firms

Banks, insurers, investment firms and their kind report major incidents under DORA. The timings are in Delegated Regulation 2025/301: an initial notification "within four hours from the classification" of the incident as major and no later than 24 hours from becoming aware of it. An intermediate report follows within 72 hours of that, and a final report within a month.

United States

There is no single federal breach law. A company can fall under a sector rule, a securities rule and several state laws for the same incident.

Federal rules

• SEC, public companies. Form 8-K Item 1.05 must be filed "within four business days after the registrant determines that it has experienced a material cybersecurity incident". The final rule took effect in September 2023. The clock starts at the materiality decision, which must itself be made without unreasonable delay.
• HIPAA, health data. The Breach Notification Rule requires notice to individuals "without unreasonable delay and in no case later than 60 calendar days after discovery". Breaches of 500 or more people are reported to the government at the same time; smaller ones are reported after the end of the calendar year.
• FTC Safeguards Rule, non-bank financial firms. 16 CFR 314.4(j) requires notice to the FTC "as soon as possible, and no later than 30 days after discovery" where at least 500 consumers are involved. That paragraph took effect in May 2024.

State laws

Every state has its own law. Three large ones now share a 30-day outer limit for telling affected residents.

California's 30-day limit is new, in effect since 1 January 2026. New York's allows delay only for law enforcement. Florida's allows 15 more days for good cause.

Canada, Australia, New Zealand and South Africa

These laws avoid a fixed number of hours.

• Canada. PIPEDA section 10.1 requires a report "as soon as feasible after the organization determines that the breach has occurred", where there is a real risk of significant harm.
• Australia. The regulator's guidance describes a duty to assess a suspected breach within 30 days, then notify as soon as practicable.
• New Zealand. The law says as soon as practicable. The Privacy Commissioner adds an expectation: "Ideally you'll do that within 72 hours".
• South Africa. POPIA section 22 requires notice "as soon as reasonably possible after the discovery of the compromise".

Rules often quoted that are not in force

Two deadlines appear in many articles as if they applied today.

CIRCIA, United States. The 2022 act sets 72 hours for covered cyber incidents and 24 hours for ransom payments by critical-infrastructure entities. CISA's page says reporting "will not be required until the CIRCIA final rule goes into effect", and that it "continues to work on the final rule".

A 96-hour GDPR clock. In November 2025 the European Commission proposed changing Article 33 to 96 hours and raising the threshold to high-risk breaches. EUR-Lex lists the procedure as ongoing. Until it is adopted, the deadline is 72 hours.

India's new data protection rules, notified in November 2025, also contain a 72-hour breach rule that does not start until eighteen months after publication.

Does an IT provider have to report?

This is the question managed service providers ask most, and the answer changes by law.

Under GDPR, a provider handling a customer's data is a processor. Article 33(2) is short: "The processor shall notify the controller without undue delay after becoming aware of a personal data breach." The provider tells its customer. The customer tells the regulator.

Under NIS2, a provider can be in scope itself. Managed service providers and managed security service providers are named in the implementing regulation, and an in-scope provider reports its own significant incidents.

In the US, the provider's duty usually runs to its customer too, with different clocks: 60 days for a HIPAA business associate, 30 days in New York, 10 days for a third-party agent in Florida, and "immediately following discovery" in California.

What to prepare before an incident

1. List which regimes apply to you. Where your customers and staff live, your sector, and whether you are listed on a stock exchange.
2. Decide who declares "aware". The clock starts there, so the decision needs a named owner.
3. Keep the regulator's reporting form to hand for each regime on your list.
4. Check your contracts. Customer contracts and card-brand rules often set shorter deadlines than the law.
5. Know what was exposed. A current backup helps you work out what was lost; see Microsoft 365 backup pricing compared.
6. Reduce the odds. Many breaches begin with a flaw already known to be exploited. How small teams can use the CISA KEV catalog covers what to patch first.

1. Close the easy routes in. Spoofed email is one of them; see what Google, Yahoo and Microsoft require for SPF, DKIM and DMARC.

How these clauses were read, and what a desk-research label means, is set out on the methodology page.