How quickly must a business report a data breach?
Short answer
It depends on the law and sector. Under the EU GDPR, organizations must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that poses a risk to individuals. Other countries, states and industries set their own deadlines.
The details
Know which laws and contracts apply before an incident, and list the deadlines in your incident response plan. Customer contracts and cyber insurance policies often have their own notification requirements.
Terms explained
- GDPR
- The General Data Protection Regulation (GDPR) is the European Union’s law on the processing of personal data, including security and breach notification duties.
- Incident response
- Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
Sources
Related questions
Related Guides
GuideIncident Response
How to Backup Data on Windows 11: A Step-by-Step Guide
Learn how to backup data on Windows 11 using built-in tools, external drives, and isolation practices to defend against hardware failure and ransomware.
Read more GuideGRC
7 Steps for GDPR Data Breach Response: A Tactical Plan
Execute a compliant GDPR data breach response with this 7-step guide covering containment, risk assessment, supervisory notification, and internal logging.
Read more GuideIncident Response
The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
Read more GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more