Breach notification

Breach notification rules compared

Last checked 24 October 2026 · 11 sources

Short answer

Deadlines range from a few days to 60 days. The EU GDPR asks controllers to notify the authority without undue delay and, where feasible, within 72 hours ¹. The UK ICO applies the same 72 hours ². US HIPAA allows up to 60 days for individual notice ³. The FTC Safeguards Rule sets 30 days ⁴. Brazil sets three business days ⁵. Canada uses as soon as feasible ⁶. Each law starts the clock at a different point and uses a different harm test.

EU and UK: 72 hours where feasible ^1,2
US health data: No later than 60 days after discovery ³
US financial firms (FTC): No later than 30 days, 500 or more consumers ⁴
US listed companies: Four business days after materiality decision ⁷
Brazil: Three business days ⁵
Singapore: Three-day deadline ⁸

Deadlines at a glance

Jurisdiction	Who is told	Deadline	Trigger
EU (GDPR) ¹	Supervisory authority, and individuals for high risk ¹	Without undue delay, where feasible within 72 hours of awareness ¹	Risk to rights and freedoms ¹
UK (UK GDPR) ²	ICO, and individuals for high risk ²	Not later than 72 hours after becoming aware ²	Notifiable breach ²
US, HIPAA ³	Individuals, HHS, and media where more than 500 residents of a state are affected ³	No later than 60 days after discovery ³	Breach of unsecured health information ³
US, FTC Safeguards Rule ⁴	FTC ⁴	As soon as possible, no later than 30 days after discovery ⁴	Unencrypted data of at least 500 consumers ⁴
US, SEC ⁷	The public, on Form 8-K Item 1.05 ⁷	Four business days after the company decides the incident is material ⁷	Material cybersecurity incident ⁷
Canada, PIPEDA ⁶	OPC and individuals ⁶	As soon as feasible ⁶	Real risk of significant harm ⁶
Australia ⁹	OAIC and individuals ¹⁰	Statement to the Commissioner as soon as practicable ⁹	Eligible data breach, likely serious harm ¹⁰
Singapore ⁸	PDPC ⁸	Three-day deadline ⁸	Notifiable breach, checked with a PDPC self-assessment tool ⁸
India ¹¹	Affected individuals ¹¹	Without delay ¹¹	Personal data breach ¹¹
Brazil ⁵	ANPD and data subjects ⁵	Three business days ⁵	Risk or relevant harm ⁵

Where the clock starts

The GDPR counts from when the controller becomes aware of the breach, and a late notice must give reasons for the delay ¹. HIPAA counts from discovery ³. The SEC rule counts from the date the company decides an incident is material, not from the incident itself ⁷. The SEC release says disclosure may be delayed if the US Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety ⁷.

Brazil counts business days. Resolution CD/ANPD 15 of 24 April 2024 sets three business days for notice to both the ANPD and the data subjects, where no other law sets a different deadline ⁵.

Regulator, individuals or the public

Most laws separate notice to the regulator from notice to people. The GDPR requires notice to individuals only for high risk, and lists three exceptions, including encryption and disproportionate effort ¹. HIPAA adds notice to the media for breaches affecting more than 500 residents of a state or jurisdiction ³.

Some regulator notices become public. The FTC says a Safeguards Rule report may be made public ⁴. In India, the government summary says the message to individuals must explain what happened, the possible impact and the steps taken ¹¹.

Penalties for late or missing notice

UK: failing to notify the ICO of a notifiable breach can bring a fine of up to £8.7 million or 2 per cent of global turnover, according to the ICO guide ².
India: not notifying the Board or affected individuals can attract penalties of up to ₹200 crore, according to the PIB summary ¹¹.
Australia: in October 2025 the Federal Court ordered A$800,000 against Australian Clinical Labs for not giving the Commissioner a statement as soon as practicable, as reported by the OAIC ⁹.
Canada: knowingly breaking the reporting rules is an offence. The OPC does not issue fines but can refer possible offences to the Attorney General of Canada ⁶.

Status of the newer rules

The FTC Safeguards Rule breach reporting duty took effect in May 2024 ⁴. The SEC adopted its incident disclosure rule on 26 July 2023 ⁷. India notified the DPDP Rules on 14 November 2025, with an eighteen-month period for phased compliance ¹¹.

Common questions

Is the 72-hour GDPR deadline absolute?

No. The GDPR says without undue delay and, where feasible, not later than 72 hours. A notice made later must give the reasons for the delay ¹.

Which rule has the shortest deadline?

Among the rules on this page, Brazil sets three business days ⁵, Singapore refers to a three-day deadline ⁸, and the SEC sets four business days after a materiality decision ⁷.

Do US companies follow one federal deadline?

No single deadline appears in the sources read for this page. HIPAA allows up to 60 days ³, the FTC Safeguards Rule 30 days ⁴ and the SEC four business days ⁷.

Must individuals always be told?

No. Under the GDPR, people are told when the risk is high, with three exceptions ¹. In Canada, the test is a real risk of significant harm ⁶.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

GDPR breach notification explained
What GDPR Articles 33 and 34 require after a personal data breach, what a notice must contain, and how regulators have enforced the rules.
US state breach notification laws explained
How US state data breach laws work, with deadlines, regulator notice and penalties from the statutes of California, Washington, Florida and New York.
The HHS OCR breach portal explained
What the US HHS Office for Civil Rights breach portal lists, how HIPAA breaches are reported, and what the 2024 report to Congress shows.
What counts as a personal data breach
How the GDPR, the UK ICO, US HIPAA, Canada, Australia and Brazil define a personal data breach, with official examples and reporting tests.
Data protection regulators in Asia-Pacific
Breach figures, penalties and powers of privacy regulators in Australia, New Zealand, India, South Korea and Japan, from official releases.
Data protection regulators in Latin America
Regulators, sanctions and breach rules in Brazil, Chile, Argentina and Colombia, from the laws and the regulators' own pages.
How breach reporting works under PIPEDA in Canada
When Canadian organisations must report a breach to the Privacy Commissioner and notify people under PIPEDA, the harm test, record-keeping and fines.
How the Notifiable Data Breaches scheme works in Australia
When Australian entities must notify the OAIC and individuals of an eligible data breach, the serious harm test and the 30-day assessment.