Breach Notification Requirements Across Every Major Framework

It’s 2 a.m. Your security team has just confirmed that personal data was exposed. The clock is already ticking.

But which clock?

When a security incident involves personal data, your data breach notification requirements are rarely singular. Depending on the data type, jurisdiction, and affected users, you are suddenly subject to overlapping, and sometimes conflicting, legal obligations.

Here is the uncomfortable truth about incident response: the middle of a crisis is not the moment to read a statute for the first time. Pre-building your decision framework is the only responsible approach.

Let’s map the landscape.

🇪🇺 GDPR: The 72-Hour Clock

The GDPR 72 hour breach notification rule is the industry’s most famous countdown.

• Article 33: You must notify the competent supervisory authority without undue delay, and where feasible, no later than 72 hours after becoming aware of the breach.
• Article 34: You must notify affected data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

When does the clock start?

The 72 hours begin when you become ”aware” of the breach.

The EDPB interprets “aware” to mean you have a reasonable degree of certainty that a security incident has occurred resulting in the exposure of personal data. You do not need a finished investigation. You just need enough information to make a credible initial disclosure.

You can notify in phases

GDPR allows a phased approach.

1. Initial notification to the supervisory authority within 72 hours, with the information available at that time.
2. Supplementary notifications as the investigation progresses.

The initial notification can explicitly note that information is incomplete if the investigation is still ongoing.

What the notification must include

• The nature of the breach
• The categories and approximate numbers of data subjects and records affected
• The name and contact details of the DPO or other contact point
• The likely consequences of the breach
• The measures taken or proposed to address it

When individuals must be told

Notification to data subjects is required when the breach is likely to result in high risk. High-risk triggers include:

• Breaches affecting special category data
• Breaches that could enable identity theft or fraud
• Breaches affecting large numbers of individuals

HIPAA: 60 Days and HHS

The HIPAA breach notification rule timeline operates on a different scale, but with strict thresholds.

• Affected individuals: Covered entities must notify within 60 days of discovering a breach of unsecured protected health information (PHI).
• HHS: Notification within 60 days for breaches affecting 500 or more individuals.
• Smaller breaches: For breaches affecting fewer than 500 individuals, covered entities may log the breach and notify HHS annually.
• Media: For breaches affecting 500 or more individuals in a single state, prominent media outlets in that state must also be notified.

Business associates

Business associates must notify covered entities of breaches within 60 days of discovery. However, covered entities remain ultimately responsible for notifying individuals and HHS.

The encryption safe harbor

The 60-day timeline feels generous compared to GDPR’s 72 hours, but the operative phrase is ”unsecured PHI.”

PHI encrypted according to HHS standards is considered secured, and its exposure does not trigger notification obligations.

Encryption is not just a security investment. It is a structural reduction in notification risk.

US State Breach Notification Laws

50 states, 50 variations

All 50 US states have their own state data breach notification laws. And they are not uniform. They differ in:

• The definition of personal information that triggers notification
• The notification timeline
• Who must be notified
• What the notification must contain

Timelines

Some of the most demanding state timelines include Florida (30 days) and Ohio (45 days), with several other states also setting deadlines shorter than HIPAA’s 60 days. Where states set a fixed deadline, it typically falls in the 30 to 90 day range. Many others simply require notice in the most expedient time possible and without unreasonable delay.

What is typically covered

Most state laws cover a name combined with:

• Social Security number
• Financial account numbers
• Driver’s license numbers
• Medical information
• Login credentials

Some states have expanded coverage to biometric data, precise geolocation, and other categories.

The practical approach

For companies operating nationally, build your notification process around the most demanding state requirements that apply to your customer base. Notifying within 30 days, with the required content, will cover most longer-timeline requirements. Still, check for state-specific rules, such as separate notice to state regulators, that may carry their own timing.

PCI DSS: Notify the Card Brands

PCI DSS does not itself set specific notification timelines to individuals.

But a compromise of cardholder data does trigger notification obligations to the card brands (Visa, Mastercard, American Express, Discover) through your acquiring bank. The card brands run their own investigations and enforce their own forensic requirements.

The practical rule

Notify your acquiring bank immediately when you discover or suspect a breach involving cardholder data. Their incident response procedures govern what happens next.

Delays here are not just a compliance failure. They are a significant PCI DSS and card brand relationship issue.

India: DPDP Act and Rules

Under the DPDP Act data breach requirements, companies must notify both the Data Protection Board and affected data principals when a personal data breach occurs. The DPDP Rules 2025, notified in November 2025, set out the mechanics:

• Initial intimation to the Data Protection Board without delay
• A detailed report to the Board within 72 hours of becoming aware of the breach (the Board can allow longer on written request)
• Notification to affected data principals without delay

Two things that make DPDP different

1. No materiality threshold. Unlike GDPR, where individual notification depends on high risk, DPDP requires notifying both the Board and affected individuals of breaches regardless of risk severity.
2. Phased enforcement. The Rules are being phased in, with the core obligations, including breach notification, becoming fully enforceable in May 2027.

Don’t forget CERT-In

DPDP notification sits alongside, not instead of, India’s existing CERT-In requirement to report certain cybersecurity incidents within 6 hours.

The good news: if you build your breach detection and notification infrastructure to support GDPR’s 72-hour timeline, you are well positioned for DPDP’s 72-hour detailed report too. Just ensure your process can also handle the much faster CERT-In window.

Building a Multi-Framework Notification Process

If you are subject to multiple frameworks, you need a decision tree, not a hope that the right framework comes to mind mid-incident.

Step 1: What type of data was affected?

Step 2: For each applicable framework, ask:

1. Does the breach meet the notification threshold?
2. What is the notification timeline?
3. Who must be notified?
4. What content is required?

Pre-build this decision tree with legal counsel review, before an incident happens. It is the only way to make sound notification decisions on compressed timelines, under incident pressure.

Don’t Forget the Legal Hold

Once you suspect a significant breach, preserve all potentially relevant evidence.

• Instruct technical teams to preserve log files, access records, and forensic images.
• Stop routine log rotation or deletion from destroying evidence.

This is a legal hold, and it should be triggered early in your incident response process, before the investigation is complete.

Evidence destroyed after a breach creates legal liability independent of the breach itself. Do not turn one problem into two.

Ready to Simplify Compliance?

Regodit builds breach notification procedures and decision trees that cover GDPR, HIPAA, PCI DSS, DPDP, and applicable US state laws.

If you want a notification process that works under the 72-hour clock, rather than one you are building during an incident, explore Regodit and schedule a demo with the team.