Directory · 16 entries

Data breach notice laws directory

This directory lists breach notification rules by law. Each row says who must notify, the deadline and who receives the notice. The EU rule sets 72 hours for notice to the supervisory authority ¹. US listed companies file Form 8-K Item 1.05 four business days after a materiality decision ⁴. India's CERT-In directions set 6 hours ¹⁰. Blank cells mean the official page read did not state the fact. Check the law itself before relying on a row.

Last checked 6 November 2026

16 / 16

GDPR Article 33
Jurisdiction
European Union
Who must notify
Controller ¹
Deadline
At the latest within 72 hours of becoming aware ¹
Who is notified
Supervisory authority ¹
Source
European Commission ¹
GDPR, processor duty
Jurisdiction
European Union
Who must notify
Processor ¹
Who is notified
The controller, for every breach ¹
Source
European Commission ¹
GDPR Article 34
Jurisdiction
European Union
Who must notify
Controller ¹
Who is notified
Affected individuals when the risk is high ¹
Source
European Commission ¹
UK GDPR Article 33
Jurisdiction
United Kingdom
Who must notify
Controller ²
Deadline
Without undue delay and where feasible within 72 hours. Late notice must give reasons ²
Who is notified
The Commissioner (UK regulator) ²
Source
UK GDPR Article 33 ²
UK GDPR Article 33(2)
Jurisdiction
United Kingdom
Who must notify
Processor ²
Deadline
Without undue delay ²
Who is notified
Controller ²
Source
UK GDPR Article 33 ²
UK GDPR Article 34
Jurisdiction
United Kingdom
Who must notify
Controller ³
Who is notified
Data subjects when the breach is likely to result in a high risk ³
Source
UK GDPR Article 34 ³
SEC Form 8-K Item 1.05
Jurisdiction
United States
Who must notify
SEC registrants with a material cybersecurity incident ⁴
Deadline
Four business days after deciding the incident is material, with a possible national security delay ⁴
Who is notified
Investors, through an SEC filing ⁴
Source
SEC press release 2023-139 ⁴
HIPAA Breach Notification Rule, individuals
Jurisdiction
United States
Who must notify
Covered entities ⁵
Deadline
No later than 60 days after discovery ⁵
Who is notified
Affected individuals, and the media when more than 500 residents of a state are affected ⁵
Source
HHS ⁵
HIPAA Breach Notification Rule, HHS
Jurisdiction
United States
Who must notify
Covered entities ⁵
Deadline
60 days for 500 or more people. Within 60 days after the year end for fewer ⁵
Who is notified
HHS Secretary ⁵
Source
HHS ⁵
HIPAA, business associates
Jurisdiction
United States
Who must notify
Business associates ⁵
Deadline
No later than 60 days from discovery ⁵
Who is notified
Covered entity ⁵
Source
HHS ⁵
FTC Health Breach Notification Rule
Jurisdiction
United States
Who must notify
Businesses covered by the rule holding electronic personal health records ⁶
Who is notified
FTC and, in some cases, the media ⁶
Source
FTC ⁶
California Civil Code 1798.82
Jurisdiction
United States
Who must notify
Businesses ⁷
Who is notified
California residents whose unencrypted personal information was acquired. Sample notice to the Attorney General when more than 500 residents are told ⁷
Source
California Attorney General ⁷
Notifiable Data Breaches scheme
Jurisdiction
Australia
Who must notify
Organisations and agencies covered by the Privacy Act 1988 ⁸
Who is notified
Affected individuals and the OAIC when serious harm is likely ⁸
Source
OAIC ⁸
PIPEDA breach of security safeguards
Jurisdiction
Canada
Who must notify
Organisations with a breach creating a real risk of significant harm ⁹
Deadline
Individuals told as soon as feasible. Records kept 24 months ⁹
Who is notified
Privacy Commissioner, individuals and bodies that can reduce harm ⁹
Source
OPC ⁹
CERT-In directions of 28 April 2022
Jurisdiction
India
Who must notify
Entities covered by the directions ¹⁰
Deadline
Within 6 hours of noticing listed incidents ¹⁰
Who is notified
CERT-In ¹⁰
Source
CERT-In ¹⁰
ANPD Resolution 15 of 24 April 2024
Jurisdiction
Brazil
Who must notify
Controllers ¹¹
Deadline
Three working days, as applied in a federal body's December 2025 ordinance ¹²
Who is notified
ANPD and data subjects ¹²
Source
ANPD ¹¹

Notes

Brazil: ANPD says controllers must keep records of security incidents with personal data for at least five years ¹¹.
United States: the FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have breach notice laws ⁶. Only California is listed here.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.

GDPR Article 33

GDPR, processor duty

GDPR Article 34

UK GDPR Article 33

UK GDPR Article 33(2)

UK GDPR Article 34

SEC Form 8-K Item 1.05

HIPAA Breach Notification Rule, individuals

HIPAA Breach Notification Rule, HHS

HIPAA, business associates

FTC Health Breach Notification Rule

California Civil Code 1798.82

Notifiable Data Breaches scheme

PIPEDA breach of security safeguards

CERT-In directions of 28 April 2022

ANPD Resolution 15 of 24 April 2024

Notes

Sources