July 10, 202611 min read

Data Breach Notification: The Regulatory Timelines You Are Required to Meet

Sources:SEC Cybersecurity Disclosure Rules - Form 8-K Requirements|HHS HIPAA Breach Notification Rule|IAPP Data Breach Notification Chart

Eric Bang

Founder & Cybersecurity Evangelist

72 hours

GDPR Article 33 requirement to notify the supervisory authority after becoming aware of a personal data breach

4 business days

SEC Form 8-K requirement for public companies to disclose material cybersecurity incidents after determining materiality

60 days

HIPAA maximum notification window to affected individuals and HHS after discovery of a breach of protected health information

50 states + DC

all US states plus DC have data breach notification laws with different covered data types, timelines, and AG notification requirements

GDPR: 72-hour supervisory authority notification

GDPR Article 33 applies to organizations that process personal data of EU residents — regardless of where the organization is headquartered.

Who is required to notify

Data controllers (organizations that determine the purposes and means of processing personal data) are required to notify. Data processors (organizations that process data on behalf of a controller, such as cloud service providers or outsourced IT) must notify the data controller 'without undue delay' upon becoming aware of a breach — the controller then notifies the supervisory authority.

The 72-hour window

Notification to the relevant EU supervisory authority (the Data Protection Authority in the EU member state where your organization is established, or the lead authority for cross-border processing) must occur within 72 hours of becoming aware that a personal data breach has occurred. 'Becoming aware' is the organization having reasonable certainty that an incident has occurred — not a preliminary suspicion, but not a completed investigation either. If the full facts are not known within 72 hours, a phase-one notification can be filed with available information, with a follow-up when investigation is complete.

What GDPR notification must contain

Per Article 33: the nature of the personal data breach including categories and approximate number of data subjects and personal data records concerned; the name and contact details of the data protection officer or other contact point; the likely consequences of the breach; the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

Article 34: Notification to data subjects

When a breach is likely to result in high risk to individuals' rights and freedoms, GDPR Article 34 also requires notification to the affected individuals 'without undue delay.' The threshold for individual notification is higher than for supervisory authority notification — not all breaches requiring authority notification also require individual notification. Legal counsel must assess the high-risk threshold for the specific breach facts.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

HIPAA: 60-day breach notification rule

HIPAA's Breach Notification Rule applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates (organizations handling PHI on their behalf).

What constitutes a reportable breach

A breach under HIPAA is the acquisition, access, use, or disclosure of protected health information (PHI) in a manner not permitted by the Privacy Rule — unless the covered entity demonstrates the information was not actually acquired or viewed, or the risk of harm to individuals is low using a four-factor risk assessment (nature of PHI, identity of unauthorized person, whether PHI was actually acquired, extent to which risk has been mitigated). This four-factor risk assessment is the 'harm threshold' — breaches below this threshold do not require notification.

Individual notification: 60-day window

Covered entities must notify affected individuals within 60 calendar days of discovery of a breach. For breaches affecting 500 or more individuals in a state, simultaneous notification to prominent media outlets in that state is also required. The 60-day clock runs from 'discovery' — the date the covered entity knew or should reasonably have known of the breach, even if the full scope is not yet determined.

HHS notification

HHS must be notified of all breaches. For breaches affecting 500 or more individuals, notification to HHS must occur simultaneously with individual notification (within 60 days of discovery). For breaches affecting fewer than 500 individuals, notification to HHS occurs annually — by March 1 of the following year — through the HHS breach reporting portal.

Business associate obligations

Business associates who discover a breach must notify the covered entity within 60 days of discovery. The covered entity is then responsible for notification to individuals and HHS. Business associate agreements must specify breach notification timelines — many BAAs require faster notification (within 10 or 30 days) than the HIPAA minimum.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

SEC: 4 business day material incident disclosure

The SEC's cybersecurity disclosure rules, effective December 2023, apply to publicly traded companies registered with the SEC.

The materiality determination

The 4 business day clock does not start at breach discovery — it starts when the company determines the incident is 'material.' Materiality is a securities law concept: a reasonable investor would consider the information important to their investment decision. Not every cybersecurity incident is material. The materiality determination must be made by management with input from legal counsel, typically involving the General Counsel, CFO, and audit committee. Document the materiality determination process and the date it was made.

Form 8-K Item 1.05 requirements

The 8-K must include: the material aspects of the nature, scope, and timing of the incident; the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations. What it does not need to include: information that would impede the remediation or law enforcement investigation (can be delayed with DOJ consultation), specific technical details not known yet at the time of filing.

Annual disclosure on Form 10-K

Separately from incident-specific disclosure, SEC rules require annual disclosure in Form 10-K of: the company's processes for assessing, identifying, and managing material risks from cybersecurity threats; the material effects of cybersecurity risks and incidents; and board oversight of cybersecurity risks. This is a recurring disclosure requirement independent of whether a specific incident occurred.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

US state breach notification laws

All 50 US states plus DC, Puerto Rico, and US territories have data breach notification laws. The coverage varies significantly — which state's law applies depends on where the affected individuals reside, not where your company is located.

California (CCPA/CPRA) — 30 day AG notification for certain breaches

California's law requires expedient notification to affected residents and notification to the California AG if more than 500 California residents are affected. California's covered data definition is broad and includes unique biometric data identifiers, government ID numbers, and account credentials in addition to traditional PII. CCPA private right of action allows individuals to sue for statutory damages in data security failures involving specified data elements without actual harm.

New York SHIELD Act — expedient notification

New York requires notification 'in the most expedient time possible and without unreasonable delay' — no specific day count. However, the SHIELD Act expanded New York's covered data definition and added reasonable security requirements. New York also requires notification to the State AG and regulatory agencies for businesses exceeding 500 employees or for health and financial sector entities.

State AG notification requirements

Many states require notification to the State Attorney General in addition to affected individuals — sometimes simultaneously, sometimes within a separate window. States with AG notification requirements include California, New York, Colorado, Virginia, and others. Aggregate the state AG notification requirements as part of your breach response process — a multi-state incident may require AG notifications to 20+ states.

Covered data varies by state

What constitutes covered data (triggering notification obligations) varies by state. All states cover Social Security numbers. Most cover financial account numbers with access credentials. Fewer cover medical information, biometric data, or login credentials alone. Some states (California, New York, Montana) have among the broadest covered data definitions. Before sending notification, legal must determine which states' laws apply and what data types in the breach trigger each.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Building a notification readiness process

Notification readiness cannot be built during an incident. These elements must be in place before.

Maintain a current data map that includes individual residency

Breach notification applicability depends on where affected individuals reside, not where your company is located. A data map that identifies: what personal data you hold, of which categories, for individuals in which states and countries — allows you to rapidly determine which regulatory frameworks apply when a breach occurs. Without this map, determining regulatory applicability during an incident takes days you may not have.

Pre-identify legal counsel for each jurisdiction

For organizations that operate across multiple jurisdictions (US + EU, or multiple US states with complex breach laws), pre-identify which legal counsel handles which jurisdiction before a breach. Engaging new outside counsel during a breach adds days to the process. Your EU data protection counsel and your US breach counsel should be identified and briefed on your organization before an incident.

Draft templated notifications for each scenario

Pre-draft notification templates for: GDPR supervisory authority notification, HIPAA individual notification letter, SEC Form 8-K language, and a generic state breach notification letter. These templates are filled in with incident-specific details and reviewed by counsel — they are not sent without review — but pre-drafting eliminates the blank-page problem under time pressure.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

The regulatory notification landscape is complex and jurisdiction-dependent, but the core obligation is consistent across frameworks: notify the relevant authorities and affected individuals within the required window, with the required content, through the required channels. Missing any deadline creates compounded liability. The preparation that prevents missed notifications is done before the incident: data mapping, pre-identified legal counsel, and templated notifications that can be adapted in hours rather than drafted from scratch under pressure.

Frequently asked questions

Does GDPR apply to non-EU companies?

Yes. GDPR applies to any organization that processes personal data of EU residents, regardless of where the organization is established. A US-headquartered company with European customers, European employees, or European website visitors that processes personal data of those individuals is subject to GDPR. The relevant supervisory authority for non-EU organizations with a designated EU representative is typically the authority in the EU member state where the representative is established.

What is the difference between breach notification and regulatory reporting?

Breach notification typically refers to the obligation to notify affected individuals (customers, employees) whose personal data was compromised. Regulatory reporting refers to notification to government authorities (EU supervisory authorities, HHS, SEC, state AGs). Both may be required simultaneously. GDPR requires both authority notification (Article 33) and individual notification for high-risk breaches (Article 34). HIPAA requires both individual notification and HHS reporting. US state laws typically require both individual notification and in some cases AG notification.

Can you delay breach notification if law enforcement requests it?

Yes, with conditions. In the US, law enforcement agencies (FBI, Secret Service) can request a delay in breach notification if disclosure would impede an ongoing criminal investigation. The delay is typically limited to 30 days and must be formally requested by law enforcement. For the SEC's 4-business-day rule, the SEC allows delayed disclosure if the US Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety. Any delay request should be documented in writing and reviewed by counsel.

Sources & references

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

breach notification requirements 2026 GDPR breach notification HIPAA breach notification SEC incident disclosure state breach notification laws breach notification timeline CCPA data breach regulatory breach reporting

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Data Breach Notification: The Regulatory Timelines You Are Required to Meet

GDPR: 72-hour supervisory authority notification

HIPAA: 60-day breach notification rule

SEC: 4 business day material incident disclosure

US state breach notification laws

Building a notification readiness process

The bottom line

Frequently asked questions

Does GDPR apply to non-EU companies?

What is the difference between breach notification and regulatory reporting?

Can you delay breach notification if law enforcement requests it?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway