Timeline of notice laws and official notice systems

1. 15 November 1665Historical

   First issue of the UK Gazette

   The Gazette was first published on 15 November 1665 as The Oxford Gazette and became The London Gazette in 1666. It is the UK's official public record ²⁰.

2. 4 August 1988In force

   US WARN Act enacted

   The Worker Adjustment and Retraining Notification Act was enacted as Pub. L. 100-379 and took effect 6 months later ¹.

3. 20 July 1998In force

   EU collective redundancies directive

   Council Directive 98/59/EC set minimum rules on notifying projected collective redundancies to a public authority ².

4. 26 May 2011In force

   UK PECR breach rules inserted

   Regulations 5A to 5C on personal data breaches were inserted into the UK Privacy and Electronic Communications Regulations 2003 ³.

5. 24 June 2013In force

   EU telecoms breach regulation

   Commission Regulation (EU) No 611/2013 set a 24 hour notice to the national authority for telecoms personal data breaches, where feasible ⁴.

6. July 2013In force

   EU Official Journal goes electronic

   From July 2013 only the electronic edition of the Official Journal on EUR-Lex is authentic and produces legal effects ⁵.

7. 17 July 2013Historical

   UK vehicle recall code published

   DVSA published its code of practice on vehicle safety defects and recalls ⁶.

8. 27 April 2016Historical

   GDPR adopted

   The EU adopted Regulation (EU) 2016/679, the General Data Protection Regulation ⁷.

9. 22 February 2018In force

   Australia NDB scheme starts

   Breaches from 22 February 2018 fall under the Notifiable Data Breaches scheme. Earlier breaches are not eligible data breaches ⁸.

10. 25 May 2018In force

    GDPR applies

    The GDPR started to apply, with the 72 hour notice to supervisory authorities in Article 33 ⁷.

11. 1 February 2021In force

    Singapore breach regulations in force

    The Personal Data Protection (Notification of Data Breaches) Regulations 2021 came into operation, with 500 people as the significant scale threshold ⁹.

12. 28 April 2022In force

    CERT-In 6 hour directions issued

    India's CERT-In issued directions requiring listed cyber incidents to be reported within 6 hours, effective 60 days after issue ¹⁰.

13. 14 December 2022Historical

    NIS2 and DORA adopted

    The EU adopted Directive (EU) 2022/2555 and Regulation (EU) 2022/2554 on the same day ^11,12.

14. 26 July 2023In force

    SEC adopts cyber incident rules

    The SEC adopted rules requiring Form 8-K Item 1.05 four business days after a registrant determines an incident is material ¹³.

15. 11 August 2023In force

    India DPDP Act enacted

    Parliament enacted the Digital Personal Data Protection Act ¹⁴.

16. 1 October 2023In force

    EU Official Journal published act by act

    Each act began to be published individually as an authentic Official Journal in PDF format ⁵.

17. 18 December 2023In force

    SEC Item 1.05 compliance date

    Item 1.05 disclosures begin on the later of 90 days after Federal Register publication or 18 December 2023. Smaller reporting companies get 180 more days ¹³.

18. 6 March 2024In force

    DVSA code updated

    DVSA published the latest version of its vehicle safety defects and recalls code ⁶.

19. 26 April 2024In force

    Brazil incident reporting regulation

    Brazil's ANPD published Resolution 15/2024 approving its Security Incident Communication Regulation, with incident records kept at least five years ¹⁵.

20. 18 October 2024In force

    NIS2 applies

    Member States apply NIS2 measures from 18 October 2024, and the first NIS Directive is repealed from that date ¹¹.

21. 13 December 2024In force

    EU GPSR applies

    The General Product Safety Regulation started to apply, with the Product safety recall headline and a choice of remedies ¹⁶.

22. 17 January 2025In force

    DORA applies

    EU financial entities report major ICT-related incidents under DORA ¹².

23. 13 May 2025Historical

    OAIC report for late 2024

    The OAIC published its July to December 2024 report, with 595 notifications in the period ¹⁷.

24. 20 August 2025In force

    UK PECR 72 hour limit

    The Data (Use and Access) Act 2025 inserted a 72 hour limit and a duty to give reasons for delay into PECR regulation 5A ³.

25. 14 November 2025In force

    India DPDP Rules notified

    The government announced notification of the DPDP Rules, 2025 with an 18-month phased compliance timeline ¹⁴.

26. 9 March 2026Historical

    Safety Gate 2025 figures

    The Commission reported 4,671 Safety Gate alerts in 2025, up 13%, the highest on record ¹⁸.

27. 22 April 2026In force

    Singapore PDPC reporting guide

    The PDPC published a guide for Data Protection Officers on assessing breaches and meeting the three-day deadline ¹⁹.

28. 11 September 2026Proposed

    Kenya draft notice on sensitive data

    The ODPC posted a draft public notice on prescribing additional categories of sensitive personal data under section 47 of the Data Protection Act, 2019 ²¹.

29. 30 September 2026In force

    UK regulator renamed in PECR text

    The word Commission was substituted in PECR regulation 5A, naming the Information Commission as the recipient of breach notices ³.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.