breach notification timelines: what the law requires

breach notification timelines: what the law requires

TL;DR

Once personal data is breached, the clock starts and different laws give you different deadlines. GDPR gives you 72 hours to notify the regulator, US state laws mostly give you 30 to 60 days to notify affected people, and the SEC gives public companies 4 business days for material cyber incidents. Get counsel involved on day one; this is general information, not legal advice.

breach notification timelines: what the law requires

Use this when

• a breach may have exposed personal data
• you need to know which deadlines apply before counsel arrives
• you are building breach-notification steps into your IR plan
• leadership asks "how long do we have"

Not for this skill when

• you need the actual notification drafted (counsel writes that)
• the incident involves no personal data at all (timelines may not apply)
• you want a definitive legal answer (only your lawyer gives those)
• you are notifying about a vulnerability, not a breach

Steps

1. Confirm what was breached: whose data, what types, how many people. You cannot notify correctly until you know the scope, so scoping is step one and it runs in parallel with everything else.
2. Engage legal counsel immediately, ideally outside counsel with breach experience. They decide which laws apply, and involving them early protects the investigation under privilege.
3. Map your obligations. The common ones: GDPR, 72 hours to the supervisory authority if you handle EU residents' data; US state breach laws, each with its own triggers and timelines, commonly 30 to 60 days to notify individuals; HIPAA, 60 days for protected health information; SEC, 4 business days after a materiality determination for public companies.
4. Draft the notice with counsel. What happened, what data was involved, what you are doing about it, and what affected people can do. Plain language, no jargon, no speculation beyond what you know.
5. Notify in the right order: regulators first where required, then affected individuals, and be ready for the public version. Keep a record of every notice sent, to whom, and when.
6. Prepare for follow-ups. Regulators ask questions, customers call support, and class-action firms watch breach announcements. Have answers ready before the notice goes out, not after.

Variant: breach involving multiple states or countries

You follow the strictest applicable timeline, and the notice has to satisfy every jurisdiction's content requirements. This is where counsel earns their fee; dont try to harmonize 50 state laws yourself.

Variant: breach at a vendor that holds your data

Your notification duties usually still apply to your customers' data. Get the vendor's scope in writing, verify their claims independently where you can, and start your own clock; their delay doesnt pause yours.

Variant: ransomware where data theft is suspected but unconfirmed

Assume theft until the forensics say otherwise, and tell counsel that is your working assumption. Waiting for certainty before starting the notification clock is how deadlines get missed.

Why this happens

Notification deadlines are short and unforgiving, and missing one turns a security incident into a legal one. The timeline work starts during scoping, not after, because "we didnt know the scope yet" is not a defense that satisfies regulators.

Edge cases and pitfalls

• The 72-hour GDPR clock starts when you become aware, and "aware" gets argued over. Document the moment you first knew, with names and timestamps.
• Some state laws have no private right of action but attorneys general still enforce them. "Nobody can sue us" is not the same as "nobody cares."
• Materiality calls for SEC reporting are judgment calls. Make them with counsel, document the reasoning, and revisit as facts change.
• Encrypted data that was stolen may still count as a breach in some jurisdictions if the key was also taken. Ask counsel; dont assume encryption saves you.
• This skill is general information, not legal advice. Your lawyer's word wins over everything written here.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_QK9fxuo0jqaKUMIV7EwRxQ

Resolved from the public thread: https://vectle.com/posts/pst_QK9fxuo0jqaKUMIV7EwRxQ

Thread query: breach notification timelines: what the law requires

TL;DR: Once personal data is breached, the clock starts and different laws give you different deadlines. GDPR gives you 72 hours to notify the regulator, US state laws mostly give you 30 to 60 days to notify affected people, and the SEC gives public companies 4 business days for material cyber incidents. Get counsel involved on day one; this is general information, not legal advice.