Data Breach Notification Rules: What Businesses Must Report and When

The clock on a data breach starts at different moments and runs at very different speeds depending on where you operate. India’s CERT-In directions require cyber incidents to be reported within 6 hours of becoming aware of them, GDPR Article 33 sets 72 hours for notifying the supervisory authority, the US Securities and Exchange Commission requires a Form 8-K within four business days of determining an incident is material, and HIPAA allows up to 60 days.

This guide compares the main data breach notification laws side by side, explains what a notice must contain, and gives a practical timeline so you are not reading the regulations for the first time during an incident. It is general information, not legal advice, so confirm your obligations with counsel for your sector and countries.

Why Breach Notification Rules Matter

A breach is not only a technical event. The moment personal data is exposed, a legal clock may start for notifying regulators, customers, partners and sometimes the media. Missing the window can turn a manageable incident into a compliance failure, and delaying notice can leave affected people exposed to fraud for longer. The FTC’s guide for businesses states plainly that all states, the District of Columbia, Puerto Rico and the US Virgin Islands require breach notification for personal information, and that requirements vary.

The practical challenge is that you may be subject to several regimes at once. A software company with customers in Europe, India and the US may face GDPR, CERT-In and state laws for the same incident. Our data breach response guide covers the technical and communications steps, and this article focuses on who must be told, and when.

Breach Notification Deadlines at a Glance

Sources for each row are listed at the end of this article. Deadlines can change, so confirm the current text before relying on it.

GDPR: 72 Hours and What the Notice Must Say

Under Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification is not required if the breach is unlikely to result in a risk to people’s rights and freedoms. If notice comes after 72 hours, it must explain the reasons for the delay.

At a minimum, the notice must describe the nature of the breach, including the approximate number of people and records affected where possible, give the name and contact details of the data protection officer or another contact, describe the likely consequences, and describe the measures taken or proposed. If all the information is not available at once, it may be provided in phases. A processor must notify the controller without undue delay after becoming aware of a breach, so your vendor contracts should state how fast.

India: CERT-In’s 6 Hours and the DPDP Rules

CERT-In’s 2022 directions require service providers, intermediaries, data centres, body corporates and government organisations to report cyber incidents within 6 hours of becoming aware or being notified, according to a Mondaq overview of the directions. Reportable incidents include data breaches and leaks, phishing attacks, unauthorised access to IT systems or data, and compromise of critical systems. Covered entities must also keep logs of all their ICT systems for a rolling 180 days within Indian jurisdiction.

India’s Digital Personal Data Protection Rules, notified on 13 November 2025, add a data protection layer. According to Hogan Lovells, data fiduciaries must intimate the Data Protection Board without delay after discovering a breach, file a detailed report within 72 hours with extensions possible on written request, and notify affected individuals promptly through their registered channels. The initial report covers the nature, scope, timing, location, causes, consequences and mitigation, and the follow-up covers remedial actions, findings on the cause and proof that individuals were notified. The same analysis notes that the breach intimation obligations take effect 13 May 2027, about 18 months after the Rules were notified. Until then, CERT-In’s 6 hour rule is the operational constraint for many Indian businesses. For wider compliance context, see our guide to tech regulation in 2026.

United States: SEC, HIPAA and the State Patchwork

SEC disclosure for public companies

The SEC’s cybersecurity rules require registrants to file Form 8-K Item 1.05 within four business days after determining that an incident is material, describing its nature, scope and timing and its material or reasonably likely material impact. Disclosure may be delayed if the US Attorney General determines that immediate disclosure would threaten national security or public safety. Annual reports must also describe processes for managing material cybersecurity risks, board oversight and management’s role.

HIPAA for health data

For covered entities, HHS says individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must be reported to the HHS Secretary within the same limit, while smaller breaches may be reported annually, no later than 60 days after the end of the calendar year. Media notice is required when more than 500 residents of a state or jurisdiction are affected, and a business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovery.

State laws and the FTC’s guidance

The FTC’s guide tells businesses to notify law enforcement immediately, notify affected businesses whose data you hold, and notify individuals quickly while coordinating timing with law enforcement. It suggests considering free credit monitoring for at least one year when financial data or Social Security numbers are exposed. State laws may dictate what a notice must or must not contain, so check both state and federal requirements.

What a Good Breach Notice Contains

The FTC’s guide recommends that a notice explain how the breach happened, what information was taken and how it has been misused if known, the actions you have taken, and steps individuals can take based on the exposed data, such as fraud alerts or credit freezes with referral to IdentityTheft.gov. Include contact information and how you will share updates, and law enforcement details if the agency agrees. Keep the language plain and accurate, avoid misleading statements, and do not disclose details that would put consumers at further risk.

If stolen data may be circulating, remind readers that criminals sell and reuse credentials. Our explainer on stolen data on the dark web helps you describe that risk without alarm.

A Practical Notification Timeline

A small business cybersecurity audit is the easiest way to find the gaps in logging, ownership and vendor terms before an incident exposes them.