Home / Regulators Austria 1 Regulator Österreichische Datenschutzbehörde 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dsb.gv.at/ 1 Belgium 1 Regulator Autorité de la protection des données, Gegevensbeschermingsautoriteit (APD-GBA) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.autoriteprotectiondonnees.be 1 Bulgaria 1 Regulator Commission for Personal Data Protection 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.cpdp.bg/ 1 Croatia 1 Regulator Agencija za zaštitu osobnih podataka (AZOP) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.azop.hr/ 1 Cyprus 1 Regulator Cypriot Data Protection Authority 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dataprotection.gov.cy/ 1 Czech Republic 1 Regulator Office for Personal Data Protection 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://uoou.gov.cz/ 1 Denmark 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.datatilsynet.dk/ 1 Estonia 1 Regulator Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.aki.ee/ 1 Finland 1 Regulator Office of the Data Protection Ombudsman 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.tietosuoja.fi/en/ 1 France 1 Regulator Commission Nationale de l'Informatique et des Libertés (CNIL) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.cnil.fr/ 1 Germany 1 Regulator Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), federal level 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.bfdi.bund.de/ 1 Greece 1 Regulator Hellenic Data Protection Authority 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dpa.gr/ 1 Hungary 1 Regulator Hungarian National Authority for Data Protection and Freedom of Information 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.naih.hu/ 1 Ireland 1 Regulator Data Protection Commission 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dataprotection.ie/ 1 Italy 1 Regulator Garante per la protezione dei dati personali 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.garanteprivacy.it/ 1 Latvia 1 Regulator Data State Inspectorate 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.dvi.gov.lv/ 1 Lithuania 1 Regulator State Data Protection Inspectorate 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://vdai.lrv.lt/ 1 Luxembourg 1 Regulator Commission Nationale pour la Protection des Données 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.cnpd.lu/ 1 Malta 1 Regulator Office of the Information and Data Protection Commissioner 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.idpc.org.mt/ 1 Netherlands 1 Regulator Autoriteit Persoonsgegevens 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://autoriteitpersoonsgegevens.nl/ 1 Poland 1 Regulator Urząd Ochrony Danych Osobowych (Personal Data Protection Office) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://uodo.gov.pl/ 1 Portugal 1 Regulator Comissão Nacional de Proteção de Dados (CNPD) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.cnpd.pt/ 1 Romania 1 Regulator National Supervisory Authority for Personal Data Processing 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dataprotection.ro/ 1 Slovakia 1 Regulator Úrad na ochranu osobných údajov Slovenskej republiky 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: http://www.dataprotection.gov.sk/ 1 Slovenia 1 Regulator Information Commissioner of the Republic of Slovenia 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.ip-rs.si/ 1 Spain 1 Regulator Agencia Española de Protección de Datos (AEPD) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.aepd.es/ 1 Sweden 1 Regulator Integritetsskyddsmyndigheten 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.imy.se/ 1 Iceland (EEA) 1 Regulator Persónuvernd (Icelandic Data Protection Authority) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.personuvernd.is 1 Liechtenstein (EEA) 1 Regulator Data Protection Authority, Principality of Liechtenstein 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.datenschutzstelle.li 1 Norway (EEA) 1 Law GDPR, EDPB member authority 2 ,1 Breach notice deadline Without undue delay, where feasible within 72 hours 2 Maximum fine in law €20 million or 4% of worldwide annual turnover, whichever is higher 3 Register or website Website: https://www.datatilsynet.no 1 United Kingdom 4 Regulator Information Commissioner's Office (ICO) 4 Law UK GDPR and Data Protection Act 2018 4 Breach notice deadline Not later than 72 hours after becoming aware 7 Maximum fine in law £17.5 million or 4% of worldwide annual turnover, whichever is higher 4 Register or website Enforcement register: https://ico.org.uk/action-weve-taken/enforcement/ 8 United States, health data 5 Regulator HHS Office for Civil Rights 9 Law HIPAA Breach Notification Rule, 45 CFR 164.400 to 414 5 Breach notice deadline No later than 60 days after discovery 5
Maximum fine in law Not confirmed in sources read Register or website Breach portal: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf 9 United States, federal consumer protection 10 Regulator Federal Trade Commission 10 Law FTC Act Section 5 and Safeguards Rule 10 ,11 Breach notice deadline No later than 30 days after discovery, 500 or more consumers 11 Maximum fine in law Civil penalty per violation of a rule or final order, amount set under 16 CFR 1.98(d) 10 Register or website Authority overview: https://www.ftc.gov/about-ftc/mission/enforcement-authority 10 United States, listed companies 12 Regulator Securities and Exchange Commission 12 Law Form 8-K Item 1.05, adopted 26 July 2023 12 Breach notice deadline Four business days after materiality decision 12
Maximum fine in law Not confirmed in sources read Register or website Rule release: https://www.sec.gov/newsroom/press-releases/2023-139 12 California 13 Regulator Office of the Attorney General 13 Breach notice deadline Sample notice to the AG if more than 500 residents are notified 13
Maximum fine in law Not confirmed in sources read Register or website Breach search: https://oag.ca.gov/privacy/databreach/reporting 13 Washington 14 Regulator Attorney General 14 Breach notice deadline 30 calendar days to consumers, AG within 30 days if more than 500 residents 14
Maximum fine in law Not confirmed in sources read Register or website Statute: https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010 14 Florida 15 Regulator Department of Legal Affairs 15 Law Florida Statutes 501.171 15 Breach notice deadline 30 days, 15 more for good cause, if 500 or more residents 15 Maximum fine in law Up to US$500,000 per breach for notice failures 15 Register or website Statute: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html 15 New York 16 Regulator Attorney General, Department of State, State Police 16 Law General Business Law 899-aa 16 Breach notice deadline Within 30 days of discovery 16 Maximum fine in law Greater of US$5,000 or up to US$20 per failed notice, the latter capped at US$250,000 16 Register or website Statute: https://www.nysenate.gov/legislation/laws/GBS/899-AA 16 Canada, private sector 6 Regulator Office of the Privacy Commissioner of Canada 6 Law PIPEDA and Breach of Security Safeguards Regulations 6 Breach notice deadline As soon as feasible 6 Maximum fine in law Offence fines via referral to the Attorney General. The OPC issues no fines 6 Register or website Annual report: https://www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/202425/ar_202425/ 17 Australia 18 Regulator Office of the Australian Information Commissioner (OAIC) 18 Law Privacy Act 1988, Notifiable Data Breaches scheme 18 Breach notice deadline Statement to the Commissioner as soon as practicable 19 Maximum fine in law Greater of A$50 million, three times the benefit, or 30% of adjusted turnover, for a body corporate since 13 December 2022 19 Register or website NDB reports: https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications 20 Singapore 21 Regulator Personal Data Protection Commission (PDPC) 21 Law Personal Data Protection Act 21 Breach notice deadline Three-day deadline 21
Maximum fine in law Not confirmed in sources read Register or website Report a breach: https://www.pdpc.gov.sg/report-data-breach 21 India 22 Regulator Data Protection Board 22 Law DPDP Rules, 2025, notified 14 November 2025 22 Breach notice deadline Affected individuals told without delay 22 Maximum fine in law Up to ₹250 crore for failing to keep security safeguards 22 Register or website Government summary: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf 22 Brazil 23 Regulator Autoridade Nacional de Proteção de Dados (ANPD) 23 Law LGPD Article 48 and Resolution CD/ANPD 15/2024 23 Breach notice deadline Three business days 23 Maximum fine in law 2% of revenue in Brazil, up to R$50,000,000 per infraction 24 Register or website Incident reporting: https://www.gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento/comunicado-de-incidente-de-seguranca-cis 23 South Africa 25 Regulator Information Regulator 25 Law Protection of Personal Information Act (POPIA) 25 Breach notice deadline As soon as reasonably possible after discovery 25
Maximum fine in law Not confirmed in sources read Register or website Enforcement notices: https://inforegulator.org.za/enforcement-notices/ 26 Kenya 27 Regulator Data Commissioner 27 Law Data Protection Act (Cap. 411C) 27
Breach notice deadline Not confirmed in sources read Maximum fine in law Up to KSh 5 million or 1% of annual turnover, whichever is lower 27 Register or website Act text: https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31 27 Nothing matches. Clear the search or pick another filter.
Notes For Germany, the EDPB member list names the federal authority, the BfDI 1 The GDPR lower tier of €10 million or 2% applies to duties such as breach notice under Articles 25 to 39 3 US state rows show four states only. The NCSL says every state has a breach law 28 Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com .
Sources EDPB: Members EUR-Lex: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (consolidated text) legislation.gov.uk: Regulation (EU) 2016/679, Article 83, General conditions for imposing administrative fines (original version as adopted by the EU) ICO: The maximum amount of a fine under UK GDPR and DPA 2018 HHS: Breach Notification Rule Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards ICO: Personal data breaches: a guide (20 August 2025) ICO: Enforcement action HHS Office for Civil Rights: Breach Portal FTC: A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority (revised July 2025) FTC: FTC Safeguards Rule: What Your Business Needs to Know SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (26 July 2023) State of California Department of Justice, Office of the Attorney General: Data Security Breach Reporting Washington State Legislature: RCW 19.255.010 Florida Legislature: Florida Statutes 501.171, Security of confidential personal information New York State Senate: General Business Law Section 899-AA Office of the Privacy Commissioner of Canada: Prioritizing privacy in a data-driven world, 2024-2025 Annual Report to Parliament on the Privacy Act and the Personal Information Protection and Electronic Documents Act (5 June 2025) OAIC: About the Notifiable Data Breaches scheme OAIC: Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach in first for Privacy Act (9 October 2025) OAIC: Notifiable Data Breaches Report: July to December 2024 (13 May 2025) PDPC: Report Your Organisation's Data Breach Press Information Bureau, Government of India: DPDP Rules, 2025 Notified (17 November 2025) ANPD: Comunicação de Incidente de Segurança Presidência da República: Lei nº 13.709, de 14 de agosto de 2018, Lei Geral de Proteção de Dados Pessoais Information Regulator (South Africa): Who makes an application to process Special Personal Information? Information Regulator: Enforcement Notices Kenya Law: Data Protection Act (Cap. 411C) NCSL: Security Breach Notification Laws (updated 17 January 2022) 