How long do you have to report a data breach?

It depends on the law. Under the GDPR, the supervisory authority must be notified within 72 hours of becoming aware of a breach where feasible. HIPAA requires notifying individuals no later than 60 days after discovery. US state laws vary. Contracts may impose shorter deadlines. Legal counsel should determine which apply.

Do all data breaches have to be reported?

Not always. Many laws include thresholds, for example the GDPR exempts breaches unlikely to result in a risk to individuals from reporting to the authority, though they must still be documented internally. US state laws define which data types trigger notification. Legal counsel should assess each breach against the applicable rules.

When does the notification clock start?

Usually when the organisation becomes aware of the breach, or discovers it, depending on the law, rather than when the investigation is complete. That is why fast detection, scoping, and escalation to legal counsel matter. Many regimes allow initial notifications with incomplete information, followed by updates as facts emerge.

Do vendors have to notify their customers of a breach?

Often, yes. Under the GDPR, processors must notify the controller without undue delay after becoming aware of a personal data breach. Contracts commonly require vendors to notify customers within set timeframes. The customer, as controller or data owner, then assesses its own notification obligations to regulators and individuals.

What happens if a company notifies late?

Consequences depend on the law and regulator. They can include fines, regulatory orders requiring security improvements, additional scrutiny in litigation, and reputational damage. Regulators often consider whether delays were justified by genuine investigation needs. Documenting when the organisation became aware, and why each decision was made, matters when timing is later examined.

What Is Data Breach Notification?

Data breach notification is the legal duty to inform regulators, affected individuals, and sometimes others when certain data is compromised. Rules differ: the GDPR requires notifying the supervisory authority within 72 hours of awareness where feasible, every US state has a notification law, and sector rules such as HIPAA add their own deadlines.

What notification means

When a breach affects certain kinds of data, laws require organisations to tell specific parties: data protection regulators, the affected individuals, and sometimes credit reporting agencies, law enforcement, business partners, or the public. The obligation exists so people can protect themselves, for example by changing passwords or watching for fraud, and so regulators can oversee how organisations handle data.

Major regimes

The obligations that apply depend on where affected people live, what sector the organisation operates in, and what kind of data was involved. These are the regimes engineering teams most often encounter.

GDPR and UK GDPR

A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. Where the breach is likely to result in a high risk, affected individuals must also be informed without undue delay.

US state laws

Every US state has a breach notification law. Definitions of covered personal information, notification thresholds, deadlines, and requirements to notify state regulators differ between states, so a single incident affecting residents of many states can carry many obligations.

US sector rules

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery, with additional reporting to the Department of Health and Human Services. Public companies must disclose material cybersecurity incidents to the SEC on Form 8-K within four business days of determining that an incident is material.

Contracts

Customer and vendor contracts often impose their own notification duties and deadlines, sometimes shorter than the law's.

What a notification usually contains

Content requirements vary, but notifications commonly describe what happened, when, what categories of data were involved, the likely consequences, what the organisation is doing in response, what individuals can do to protect themselves, and how to get more information. Regulators may ask for further detail as the investigation continues, and many regimes allow information to be provided in phases.

What engineering has to provide

Legal teams decide whether and how to notify. They can only do so with facts engineers provide:

Which systems and data were affected, from access logs, audit trails, and file access records.
Whose data, by mapping affected records to individuals and their locations, which determines which laws apply.
When, from timelines of the intrusion and its discovery.
How, the entry point and what has been done to close it.

Organisations that cannot answer these quickly either miss deadlines or notify far more people than necessary, because they cannot rule anyone out.

Notifications as phishing bait

Breach notifications create a predictable wave of scam messages impersonating the affected organisation, asking people to click links, confirm details, or pay. Reduce that risk by sending notices from recognised domains with strong email authentication, avoiding links to anything other than a page on your well-known website, telling recipients what you will never ask for, and publishing all official communications on a single page they can check.

Being ready

Keep a data inventory that maps systems to the categories of personal data they hold and the jurisdictions of the people involved. Retain access logs long enough to scope an intrusion. Include legal and privacy contacts in the incident response plan, with clear criteria for escalating to them. And rehearse: a tabletop exercise that runs a breach through to a notification decision exposes gaps far more cheaply than a real one.

Frequently asked questions

How long do you have to report a data breach?: It depends on the law. Under the GDPR, the supervisory authority must be notified within 72 hours of becoming aware of a breach where feasible. HIPAA requires notifying individuals no later than 60 days after discovery. US state laws vary. Contracts may impose shorter deadlines. Legal counsel should determine which apply.
Do all data breaches have to be reported?: Not always. Many laws include thresholds, for example the GDPR exempts breaches unlikely to result in a risk to individuals from reporting to the authority, though they must still be documented internally. US state laws define which data types trigger notification. Legal counsel should assess each breach against the applicable rules.
When does the notification clock start?: Usually when the organisation becomes aware of the breach, or discovers it, depending on the law, rather than when the investigation is complete. That is why fast detection, scoping, and escalation to legal counsel matter. Many regimes allow initial notifications with incomplete information, followed by updates as facts emerge.
Do vendors have to notify their customers of a breach?: Often, yes. Under the GDPR, processors must notify the controller without undue delay after becoming aware of a personal data breach. Contracts commonly require vendors to notify customers within set timeframes. The customer, as controller or data owner, then assesses its own notification obligations to regulators and individuals.
What happens if a company notifies late?: Consequences depend on the law and regulator. They can include fines, regulatory orders requiring security improvements, additional scrutiny in litigation, and reputational damage. Regulators often consider whether delays were justified by genuine investigation needs. Documenting when the organisation became aware, and why each decision was made, matters when timing is later examined.

Key takeaways

Notification duties depend on the data involved, the people affected, and the jurisdictions and sectors that apply.
Under the GDPR, authorities must be notified within 72 hours of awareness where feasible, and individuals when risk is high.
All US states have breach notification laws, with differing definitions and deadlines.
Deadlines usually run from awareness, so detection and scoping speed matter directly.
Engineering provides the facts: what data, whose data, when, and how.