Data breach notification laws compared

Two separate duties: tell the regulator, tell the people affected

Most breach laws split the duty in two. One notice goes to a regulator. A second goes to the people whose data was exposed. The tests and deadlines for each are often different.

Under the UK GDPR, Article 33 covers notice to the regulator. The controller must act without undue delay and, where feasible, within 72 hours of becoming aware of the breach ². No notice is needed where the breach is unlikely to result in a risk to the rights and freedoms of natural persons ². A late notice must give reasons for the delay ².

Article 34 covers notice to individuals. It applies when the breach is likely to result in a high risk to the rights and freedoms of natural persons ³. The European Commission gives encryption as an example of protection that can make the risk unlikely to materialise ¹.

Comparison table

United States: federal and state layers

The United States has no single breach law. The FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws that require notice of breaches involving personal information ⁷. Firms covered by the FTC Health Breach Notification Rule must notify the FTC and, in some cases, the media ⁷.

California law requires a business or state agency to notify any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorised person ⁶. A business that notifies more than 500 California residents about one breach must send a single sample copy of the notice to the Attorney General ⁶.

For health data, HIPAA covered entities must tell individuals without unreasonable delay and no later than 60 days after discovery ⁵. A breach affecting more than 500 residents of a state needs notice to the media as well ⁵. Business associates must tell the covered entity no later than 60 days from discovery ⁵.

Listed companies have a separate securities duty. The SEC adopted Item 1.05 of Form 8-K on 26 July 2023 ⁴. It covers any cybersecurity incident the company decides is material, and the filing must describe the nature, scope and timing of the incident and its material impact ⁴. The filing may be delayed if the US Attorney General decides disclosure would pose a substantial risk to national security or public safety ⁴.

Australia, Canada and India

In Australia, any organisation or agency covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a breach is likely to result in serious harm ⁸. The notice to individuals must include recommendations about the steps they should take ⁸.

In Canada, PIPEDA requires organisations to report breaches of security safeguards that create a real risk of significant harm to the Privacy Commissioner ⁹. The number of people affected does not change the duty ⁹. Organisations must keep a record of every breach for 24 months, reportable or not ⁹. The OPC does not prosecute or fine. It can refer possible offences to the Attorney General of Canada ⁹.

In India, CERT-In directions issued on 28 April 2022 require listed cyber incidents to be reported within 6 hours of noticing them ¹⁰. The same directions require logs to be kept for a rolling period of 180 days within Indian jurisdiction ¹⁰.

Processors and service providers

A processor that handles data for someone else usually has to tell that party first. Under Article 33(2) of the UK GDPR, the processor must notify the controller without undue delay after becoming aware of a breach ². The FTC tells businesses that store data for other businesses to notify them of a breach ⁷. The controller must document every breach, with its facts, effects and the remedial action taken ².