Data Breach Reporting | Requirements, Timelines, and Who to Notify (Complete Guide)

Data breach reporting is the legal process of notifying regulators, affected individuals, and, in some cases, the public when unauthorized access to protected data occurs. Under the major privacy regulations in force today, organizations that experience a qualifying breach face mandatory disclosure deadlines, designated reporting authorities, and escalating penalties for non-compliance.

The challenge is that no single rulebook governs data breach reporting globally. A healthcare provider in the United States answers to HIPAA and HHS OCR. A SaaS company handling EU customer data answers to GDPR and the relevant Data Protection Authority. A publicly traded company answers to the SEC. A business that holds California residents’ data answers to California’s breach notification law and the CCPA. In many cases, a single breach triggers simultaneous obligations under multiple frameworks, each with its own timeline, form, and threshold for what counts as reportable.

What unifies them all is urgency. The IBM Cost of a Data Breach Report 2026 found that the average cost of a data breach reached $4.99 million, a 12% increase and the highest figure the report has recorded, with slow detection and containment directly amplifying that cost. Organizations that used AI and automation extensively across their security operations saved an average of $1.93 million per breach and identified and contained incidents about 65 days faster. Regulators have taken note: the broad trend across most jurisdictions is toward fixed deadlines (California added a 30-day deadline in 2026), stricter enforcement, and higher fines for organizations that treat notification as an afterthought.

This guide covers everything compliance officers, security teams, and business owners need to know: which regulations apply, how long you have to report under each one, who you report to, which forms are required, and what happens if you miss the deadline.

What Is Data Breach Reporting?

Data breach reporting is the formal process by which an organization discloses a security incident involving unauthorized access, acquisition, or exposure of protected personal data to relevant regulatory authorities, affected individuals, and, in some cases, the broader public. It is a compliance obligation, not a discretionary action, triggered the moment an organization determines that a qualifying incident has occurred.

The specific mechanics of reporting vary by jurisdiction and regulation, but the core obligation is consistent: once a breach crosses a defined threshold of harm or sensitivity, the clock starts. Organizations must assess the incident, determine whether it meets the legal definition of a reportable event, identify the correct authorities, and file notification within a mandated timeframe. Failure at any of these steps carries legal and financial consequences. If you are still working out what counts as a breach in the first place, start with our guide to data breach information.

Definition of a Reportable Data Breach

A reportable data breach is a security incident in which personal, protected, or sensitive data has been accessed, disclosed, altered, or destroyed without authorization, and where that exposure creates a real or likely risk of harm to the individuals whose data was affected.

The key word in that definition is risk. Not every unauthorized access event qualifies as reportable. What separates a reportable breach from a contained security incident is whether the compromised data was actually accessible to, or acquired by, an unauthorized party, and whether that exposure poses a meaningful risk of harm. Regulators across GDPR, HIPAA, PIPEDA, and other frameworks have set their reporting thresholds based on this harm-risk principle rather than on the breach event itself.

Under GDPR, for instance, a reportable personal data breach is defined as a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data. HIPAA defines a reportable breach as the impermissible use or disclosure of protected health information that compromises its security or privacy, with a built-in presumption that any impermissible disclosure is a breach unless the covered entity can demonstrate, through a documented four-factor risk assessment, that the probability of data compromise is low.

What Qualifies as a Notifiable Breach vs. a Non-Reportable Incident

The line between a notifiable breach and a contained security incident comes down to two factors: the nature of the data involved and the realistic probability that an unauthorized party accessed or used it.

A notifiable breach typically involves data categories that regulators treat as high-risk by default: full names combined with Social Security numbers, financial account credentials, protected health information, biometric data, login credentials, or government-issued identification numbers. When data of this type is involved in an unauthorized disclosure, the presumption in most jurisdictions is that notification is required unless the organization can affirmatively demonstrate otherwise.

A non-reportable incident, by contrast, is usually one in which unauthorized access occurred. Still, the data was rendered unreadable through strong encryption, for example, or the data involved carries no realistic harm potential on its own, such as publicly available information or anonymized records. Under HIPAA’s Safe Harbor provision, a breach involving encrypted PHI where the decryption key was not also compromised is explicitly excluded from breach notification requirements. GDPR similarly allows organizations to determine that notification to affected individuals is unnecessary if the breach is unlikely to result in a high risk to their rights and freedoms. However, regulator notification may still be required even in that scenario.

The practical implication is that every security incident requires a documented risk assessment before an organization can conclude it is non-reportable. Assuming an incident doesn’t need to be reported without formal analysis is, in itself, a compliance failure.

Do All Data Breaches Need to Be Reported?

No, but the exemption threshold is narrow, and the burden of proof sits entirely with the organization. Every major privacy regulation establishes a harm-risk standard that determines whether a breach triggers notification. Still, none allow organizations to decide a breach is minor without documentation to support that conclusion.

Under HIPAA, the presumption is that every impermissible disclosure of PHI is reportable unless the covered entity or business associate can demonstrate a low probability of compromise through a documented four-factor risk assessment (covered in detail in the HIPAA section below). This presumption-of-breach rule was introduced precisely to prevent organizations from reflexively classifying incidents as non-reportable to avoid disclosure obligations.

GDPR takes a two-tier approach. Breaches must be reported to the supervisory authority unless they are unlikely to result in a risk to the rights and freedoms of natural persons. Breaches that are likely to result in a high risk require notification to affected individuals as well. This means an organization can sometimes avoid notifying data subjects while still being required to report to its Data Protection Authority; the two obligations operate independently.

Reporting also does not depend on whether anyone witnessed the discovery or whether damage has been confirmed. The obligation attaches when the organization becomes aware of a qualifying incident, so a breach that nobody saw, or that has not yet caused measurable harm, is still reportable if it meets the threshold.

The practical answer for any security team is to treat every incident involving personal data as presumptively reportable until a documented assessment concludes otherwise, and to retain that documentation, because regulators will ask for it.

Who Determines If a Breach Is Reportable?

The organization that controls the data, the data controller under GDPR, the covered entity or business associate under HIPAA, or the business under CCPA, is responsible for making the initial determination of whether a breach is reportable. That determination, often called a data breach assessment, must be made by qualified personnel, documented formally, and completed within the timeframe required by the applicable regulation, because the reporting clock often begins when the organization becomes aware of the incident, not when the investigation concludes.

In practice, this means the decision sits with the organization’s privacy officer, legal counsel, CISO, or a designated incident response team. Many organizations use a structured risk assessment framework, either built internally or prescribed by regulation, to evaluate each incident against reportability criteria. HIPAA’s four-factor risk assessment is the most codified example, but the European Data Protection Board’s guidance documents provide similarly detailed frameworks for DPA notification decisions.

Critically, being unsure whether a breach is reportable is not a valid reason to delay assessment. Regulators in both the US and the EU have issued enforcement actions against organizations that knew of a breach but delayed determining reportability while conducting broader investigations. The assessment and the investigation can, and should, run in parallel.

Data Breach Reporting Timelines by Regulation

The single most consequential variable in data breach reporting is time. Every major privacy and security regulation sets a mandatory notification deadline. In most cases, that clock starts running the moment an organization becomes aware of the incident, not when the investigation is complete. Missing a deadline is itself a compliance violation, independent of the breach that triggered it.

The timelines below reflect the current requirements under each framework as of November 2026. Organizations subject to multiple regulations, such as a US healthcare company with EU customers, must meet all applicable deadlines simultaneously, defaulting to the most restrictive.

How Long Do You Have to Report a Data Breach? (Deadlines at a Glance)

How long you have to report a data breach depends on the law that applies: 72 hours to the regulator under the GDPR and UK GDPR, 60 days under HIPAA, 30 days to notify California residents, four business days after a materiality decision for US public companies, and as little as one hour for US federal agencies. The table summarizes the main deadlines; each is explained in the sections that follow.

Deadlines are current as of November 2026. Confirm them against the regulator’s latest guidance before relying on them for a live incident.

GDPR, 72-Hour Rule Explained

Under the General Data Protection Regulation, an organization must report a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of the data controller becoming aware of it. This is one of the strictest breach notification deadlines in the world, and it applies regardless of whether the investigation is complete when the notification is filed.

The 72-hour window is not a deadline for completing the notification; it is a deadline for beginning it. GDPR explicitly permits organizations to submit an initial notification with the information available at the time and supplement it with additional details as the investigation progresses. Regulators penalize silence: failing to notify at all, or notifying significantly late without documented justification for the delay.

When a breach is also likely to pose a high risk to data subjects’ rights and freedoms, the GDPR imposes a second obligation: notifying the affected individuals themselves without undue delay. There is no fixed number of hours prescribed for this second tier, but regulators expect it to follow the supervisory authority notification closely.

Pending change: In November 2025, the European Commission proposed, through its Digital Omnibus package, extending the GDPR deadline to 96 hours, limiting regulator notification to breaches likely to result in a high risk, and routing reports through a single EU entry point. As of November 2026, the proposal has not been adopted, so 72 hours remains the deadline.

HIPAA: When Must a Breach Be Reported?

HIPAA breach reporting operates on two separate timelines depending on the scale of the breach, and both are measured from the date of discovery rather than the date of occurrence.

For breaches affecting 500 or more individuals, covered entities must notify HHS OCR and affected individuals within 60 days of discovering the breach. This 60-day window is a hard cap, not a target. Notification to the affected individuals must happen simultaneously. If the breach affects residents of a state or jurisdiction served by prominent media outlets, a press notice must also be issued within the same 60-day period.

For breaches affecting fewer than 500 individuals, covered entities have until 60 days after the end of the calendar year in which the breach was discovered to notify HHS OCR. Individual notification still occurs within 60 days of discovery. This annual reporting pathway is sometimes misread as flexibility; it is not. Individual notification is still due within 60 days of discovery, regardless of the breach’s size. Only the HHS OCR submission is deferred to the annual log.

Business associates under HIPAA must notify the covered entity of a breach within 60 days of discovery, though contracts between the parties often require faster notification; 10 or 30 days is common. HIPAA itself sets 60 days as the ceiling, not the floor.

CCPA, California Breach Reporting Deadlines

California’s breach notification requirement sits in Civil Code § 1798.82. At the same time, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), adds liability for breaches caused by inadequate security. For years, the law required notice only without unreasonable delay. That changed on 1 January 2026, when SB 446 took effect: affected California residents must now be notified within 30 calendar days of the business discovering, or being notified of, the breach.

If a breach affects more than 500 California residents, the business must also submit a sample copy of the consumer notice to the California Attorney General within 15 days of notifying those residents. Delays beyond the 30-day limit are limited to narrow exceptions, such as a law enforcement request to delay disclosure. For the full requirements, see our guide to the California data breach notification law.

CCPA liability is triggered when a business fails to implement and maintain reasonable security measures and a breach of unencrypted personal information results, giving affected individuals a private right of action. This means the regulation’s teeth are primarily in civil litigation and regulatory enforcement of security standards, with breach notification serving as the disclosure mechanism that enables enforcement.

PIPEDA, Real Risk of Significant Harm Standard

Canada’s Personal Information Protection and Electronic Documents Act requires mandatory breach reporting when a breach creates a real risk of significant harm to affected individuals. This harm-risk threshold is the central determination; unlike GDPR’s broad notification requirement, PIPEDA does not require reporting for every breach involving personal data, only those that clear the significant harm bar.

Significant harm under PIPEDA includes bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft, negative effects on a credit record, and damage to or loss of employment, business, or professional opportunities. Organizations must assess each breach against these criteria and document their reasoning, because the Office of the Privacy Commissioner of Canada (OPC) may request that documentation during an investigation.

When the significant harm threshold is met, PIPEDA requires notification to the OPC and affected individuals as soon as feasible after determining that a real risk of significant harm exists. The OPC’s guidance makes clear that “as soon as feasible” means promptly and that extended delays for the sake of investigative completeness are not acceptable.

SEC, Cyber Breach Reporting Requirements for Public Companies

The Securities and Exchange Commission’s cybersecurity disclosure rules, which took effect in December 2023, require publicly traded companies to report material cybersecurity incidents within four business days of determining that the incident is material. This is one of the most significant expansions of breach reporting obligations for the corporate sector in recent US regulatory history.

Materiality under the SEC framework follows the standard used across securities law: an incident is material if a reasonable investor would consider it important in making an investment decision. Companies are responsible for making that determination promptly; the four-day clock starts from the date of the materiality determination, not from the date of discovery. This creates a practical incentive to complete materiality assessments quickly, since delay in the assessment does not pause the reporting clock once a conclusion is reached. The rule remains in force as of November 2026, although the SEC has been reviewing its cybersecurity disclosure requirements this year.

The disclosure is made via Form 8-K, Item 1.05. What it must contain is covered under Reporting to the SEC below.

FCC Data Breach Reporting Rules

The Federal Communications Commission’s updated data breach reporting rules, which took effect in 2024, apply to telecommunications carriers and require notification on three parallel tracks: to the FBI and Secret Service, to the FCC, and to affected customers.

Carriers must notify the FBI, the Secret Service, and the FCC as soon as practicable, and no later than seven business days after reasonably determining that a breach has occurred. Customer notification must follow without unreasonable delay and no later than 30 days after that determination, unless law enforcement requests a delay, which can be granted for up to 30 days and extended in extraordinary circumstances.

The rules apply to breaches of Customer Proprietary Network Information (CPNI), the data carriers collect about customers’ use of telecommunications services, and represent a significant tightening of requirements that had remained largely unchanged since 2007. The updated framework removed the earlier mandatory seven-business-day wait before customers could be told, replacing it with a 30-day outer limit while preserving law enforcement’s ability to request a delay.

DOD / US-CERT, PII Breach Reporting Timeframes

Within the US federal government, the Department of Defense and other agencies are bound by OMB Memorandum M-17-12, which requires that breaches involving Personally Identifiable Information be reported to US-CERT, now part of CISA, within one hour of discovery. This is among the shortest breach reporting deadlines in any regulatory framework currently in force, and it is not aspirational. Federal agencies are expected to have incident response capabilities in place that enable one-hour notification.

Following the initial US-CERT notification, DOD organizations conduct a more detailed breach analysis to determine whether the PII involved creates a risk of harm to affected individuals. If it does, affected individuals must be notified within 10 days of the breach determination. The agency’s Senior Agency Official for Privacy, or a designated privacy officer, is responsible for overseeing the harm analysis and notification process.

Australia, OAIC Notifiable Data Breaches Timeline

Australia’s Notifiable Data Breaches (NDB) scheme, administered by the Office of the Australian Information Commissioner (OAIC), requires organizations covered by the Privacy Act 1988 to notify the OAIC and affected individuals as soon as practicable once they have reasonable grounds to believe an eligible data breach has occurred.

An eligible data breach under the NDB scheme is likely to result in serious harm to any individual whose information was involved. If an organization suspects a breach has occurred but is not yet certain, it has 30 days to assess whether the incident constitutes an eligible data breach. That 30-day assessment window is itself a deadline; organizations cannot conduct an indefinite investigation to avoid triggering notification obligations.

UK GDPR / ICO, 72-Hour Reporting to the ICO

Following Brexit, the United Kingdom enacted its own version of GDPR, the UK GDPR, which mirrors the EU regulation’s 72-hour notification requirement almost exactly. Organizations operating in the UK must report a personal data breach to the Information Commissioner’s Office within 72 hours of becoming aware of it, provided the breach is likely to result in a risk to the rights and freedoms of individuals.

As with EU GDPR, the 72-hour clock begins when an organization becomes aware of the breach, and organizations may submit an initial report with partial information and supplement it as the investigation develops. The ICO has published detailed guidance on what the initial report must contain: the nature of the breach, the approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address it, and expects organizations to have this information largely ready through pre-existing incident response documentation.

The ICO’s enforcement record is significant. It has issued fines ranging from hundreds of thousands to millions of pounds for late, inadequate, or no notification. It has also made clear that proactive engagement, contacting the ICO early, even before the 72-hour deadline, when a major breach is suspected, is viewed more favorably than waiting until the last moment with a complete report.

Who Do You Report a Data Breach To?

Who you report a data breach to depends on the type of data compromised, the industry you operate in, and the jurisdictions where your affected individuals reside. There is no single universal authority; most organizations subject to a significant breach must notify multiple bodies simultaneously, each with its own submission process, required format, and deadline.

The question of where to report is inseparable from which regulation governs the data involved. A breach affecting employee health records triggers HIPAA and HHS OCR. The same breach at a publicly traded company may also trigger SEC disclosure obligations. If those employees are California residents, California’s breach notification requirements apply on top. Mapping your reporting obligations before a breach occurs, not during one, is the difference between an orderly response and a compliance crisis.

Which Form Is Used to Submit a Breach Report?

There is no single breach report form; the form depends on the applicable law. For a HIPAA breach, it is the online form in the HHS OCR Breach Reporting Portal. For a GDPR breach, it is the online breach notification form of your lead supervisory authority. For a UK breach, it is the ICO’s online personal data breach report. For a material cyber incident at a US public company, it is Form 8-K, Item 1.05.

The sections below explain each form and what it asks for.

Who Should You Tell First If You Suspect a Data Breach?

If you suspect a data breach, report it internally first, immediately, to the person your incident response plan names: the privacy officer, DPO, security team, or your manager if no one is designated. Do not wait to confirm the breach, investigate it yourself, or decide whether it is serious enough. Under most regulations, the reporting clock starts when the organization becomes aware, so delays in escalation can consume the organization’s deadline.

The internal contact then decides which external authorities must be notified, using the assessment described later in this guide. Employees do not report directly to regulators on behalf of their employer.

Reporting to the ICO (UK)

In the United Kingdom, personal data breaches likely to pose a risk to individuals’ rights and freedoms must be reported to the Information Commissioner’s Office. The ICO is the UK’s independent data protection regulator and the sole supervisory authority for UK GDPR breach notifications; organizations do not report to multiple UK bodies for the same breach.

Notification is submitted through the ICO’s online breach reporting form at ico.org.uk. The report must include the nature of the breach, the categories and approximate number of individuals and personal data records affected, the likely consequences of the breach, and the measures taken or proposed to address it. Organizations are not required to have complete answers to all of these questions before filing; the ICO expects initial reports within 72 hours and accepts supplementary information as the investigation progresses.

The ICO distinguishes between breaches that require only regulator notification and those that also require notification to affected individuals. If a breach is likely to pose a high risk to individuals, including identity theft, financial loss, discrimination, or reputational damage, both the ICO and the affected individuals must be notified. If the risk is present but not high, only notification to the ICO is required. If the breach is unlikely to result in any risk, no notification is legally required, though the breach must still be documented internally.

Reporting to HHS OCR (HIPAA Breaches)

Under HIPAA, covered entities, healthcare providers, health plans, and healthcare clearinghouses report breaches of protected health information to the US Department of Health and Human Services Office for Civil Rights. HHS OCR enforces HIPAA’s Breach Notification Rule, and all formal breach submissions are made through its dedicated online portal at ocrportal.hhs.gov. The deadlines for large and small breaches are set out in the HIPAA timeline above and in the HIPAA section below.

HHS OCR publishes all reported breaches affecting 500 or more individuals on its public breach portal, commonly referred to in the industry as the HIPAA Wall of Shame. This public disclosure is itself a compliance mechanism: it creates reputational accountability and allows the public to see which covered entities have experienced significant incidents. HHS OCR is one of the most active data breach enforcement bodies in the United States, and its penalty amounts are adjusted for inflation every year. For healthcare-specific context, see our guide to healthcare data breaches.

Reporting to the SEC

Publicly traded companies in the United States report material cybersecurity incidents to the Securities and Exchange Commission via Form 8-K, Item 1.05, within four business days of determining that the incident is material (see the SEC timeline above).

The Form 8-K disclosure must describe the material aspects of the incident: its nature, scope, and timing, the data or systems affected, and the actual or reasonably likely material impact on the company’s financial condition or operations. Companies are not required to disclose specific technical details that would compromise ongoing remediation or assist threat actors. Still, they cannot use that carve-out as a general exemption from substantive disclosure. The SEC has made clear it will scrutinize both the timeliness of disclosure and whether companies are accurately characterizing incidents as immaterial to avoid the reporting obligation.

In addition to Form 8-K incident reporting, the SEC requires annual disclosure of a company’s cybersecurity risk management program, governance structure, and board-level oversight of cyber risk via Form 10-K. The two reporting streams, incident disclosure and program disclosure, are designed to give investors a complete picture of how a company manages cyber risk over time, not just when a breach occurs.

Reporting PHI Breaches: Covered Entity Obligations

When protected health information is breached, covered entities under HIPAA have layered reporting obligations that extend beyond HHS OCR. The Breach Notification Rule requires notification to three distinct parties: affected individuals, HHS OCR, and in cases involving large breaches, prominent media outlets serving the affected area. The rules for individual, substitute, and media notice are covered under Notifying Affected Individuals Under HIPAA below.

Business associates that discover a breach involving PHI are required to notify the covered entity, not HHS OCR directly. The covered entity retains primary responsibility for notifying the regulator and individuals, but the business associate must provide the covered entity with the information needed to meet those obligations. This division of responsibility is typically formalized in the Business Associate Agreement between the parties, and gaps in that agreement are a common point of enforcement scrutiny following a breach.

Reporting PII Breaches to US-CERT and DOD Authorities

Federal agencies and Department of Defense organizations that experience a breach involving Personally Identifiable Information report to the Cybersecurity and Infrastructure Security Agency’s United States Computer Emergency Response Team, US-CERT, within one hour of discovery under OMB Memorandum M-17-12 (see the DOD / US-CERT timeline above). The initial US-CERT notification is a security alert, not a comprehensive breach report; it is designed to trigger coordinated federal incident response as quickly as possible. A more detailed incident report follows as the agency’s investigation develops. DOD-specific guidance further requires that the agency’s Senior Agency Official for Privacy assess the breach’s potential for harm and, where a risk of harm to affected individuals is identified, initiate individual notification within 10 days.

The rationale for the one-hour standard is systemic: federal agencies handle PII at scale, and a breach at one agency can have cascading implications for connected systems across the government. Early warning to US-CERT is treated as a prerequisite to coordinated national-level response, not merely an administrative formality.

Reporting a Data Breach to the Social Security Administration

When a data breach exposes Social Security numbers, whether as a standalone element or part of a broader record, the Social Security Administration is not a primary breach-reporting authority, unlike HHS OCR or the ICO; there is no federal regulatory requirement to file a breach report directly with the SSA solely because SSNs were compromised.

The SSA’s role in breach response is primarily consumer-facing: it provides guidance for individuals whose Social Security numbers have been exposed, including how to monitor and protect their record through a my Social Security account and, in cases of documented, continuing identity theft, how to request a new Social Security number. Credit freezes are placed with the credit bureaus, not the SSA. Affected individuals can report SSN misuse to the SSA’s Office of Inspector General and to the Federal Trade Commission via IdentityTheft.gov.

Organizations that experience a breach involving SSNs must still meet their state-level breach notification obligations; every US state has a breach notification law that specifically includes SSNs as a trigger data element and requires notification to affected individuals so they can take protective action. The notification itself, rather than a regulator filing with the SSA, is the primary compliance obligation when SSNs are the data at risk.

State-Level Reporting Authorities in the US

All 50 US states, the District of Columbia, Puerto Rico, Guam, and the US Virgin Islands have enacted data breach notification laws, each with its own definition of covered data, trigger threshold, notification deadline, and designated authority. This patchwork of state laws means that a single breach affecting residents across multiple states can simultaneously trigger dozens of distinct notification obligations.

In most states, the primary reporting authority is the state Attorney General. Some states, including California, New York, and Texas, also require notification to the AG’s office in addition to individual notification. In contrast, others require only individual notification with no direct regulator filing. New York’s SHIELD Act, for example, requires notification to the AG, the Department of State, and the Division of State Police for breaches affecting New York residents, in addition to notifying the affected individuals.

How each state defines personal information, and the deadlines that apply, are covered under Data Breach Reporting Requirements by State below.

Where to Report a Data Breach in Australia

In Australia, organizations covered by the Privacy Act 1988 report eligible data breaches to the Office of the Australian Information Commissioner. The OAIC administers the Notifiable Data Breaches scheme and is the sole federal regulator for privacy breach notifications. Reports are submitted through the OAIC’s online notification form, and the organization must simultaneously notify affected individuals as soon as practicable.

The OAIC notification must include the organization’s identity and contact details, a description of the breach, the types of information involved, and the steps the organization recommends that affected individuals take in response. If it is not practicable to notify each affected individual directly, for example due to insufficient contact information, the organization must publish a notice on its website and take reasonable steps to publicize it.

Australia’s sector-specific regulators also play a role in breach response. The Australian Prudential Regulation Authority (APRA) governs breach obligations for banks, insurers, and superannuation funds under its CPS 234 information security standard, and ASIC administers a separate regime for financial services licensees (see ASIC Breach Reporting (RG 78) below). Organizations in regulated sectors must satisfy both the OAIC’s requirements and their sector regulator’s obligations, which may differ in terms of thresholds, timelines, and submission formats.

Reporting to FERPA, FDA, and Other Sector-Specific Regulators

Beyond the major horizontal privacy frameworks, a range of US sector-specific regulations impose breach reporting obligations on organizations in education, healthcare device manufacturing, financial services, and critical infrastructure, each with a distinct reporting authority and procedural requirements.

Under the Family Educational Rights and Privacy Act, educational institutions do not have a mandatory breach notification requirement like HIPAA or GDPR. FERPA prohibits unauthorized disclosure of student education records but does not prescribe a specific breach notification process to a regulator. In practice, institutions that experience a breach involving student records report it to the US Department of Education and notify affected students and parents, in accordance with FERPA guidance and applicable state breach notification laws. Possible FERPA violations are reported to the Family Policy Compliance Office within the Department of Education.

Clinical research has its own, separate regime. In the EU, sponsors must report serious breaches of the Clinical Trials Regulation or the trial protocol to the member states concerned within seven days of becoming aware of them; in the US, FDA-regulated sponsors report non-compliance and unanticipated problems under the FDA’s investigational drug and device rules. These are research-compliance duties, distinct from privacy breach reporting.

For critical infrastructure sectors- energy, financial services, water, transportation- the Cybersecurity and Infrastructure Security Agency coordinates incident reporting under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CIRCIA requires covered entities to report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. CISA sent its final implementing rule to the White House Office of Management and Budget on 1 October 2026, but the rule is not yet in force, so these deadlines are not yet enforceable. Organizations in these sectors may also have parallel reporting obligations to their sector-specific regulators: FERC for energy, banking regulators for financial institutions, and the TSA for transportation.

HIPAA Breach Reporting Requirements

HIPAA breach reporting requirements obligate covered entities and their business associates to notify affected individuals, HHS OCR, and, in some cases, the media whenever protected health information is accessed, used, or disclosed without authorization in a manner that compromises its security or privacy. These requirements are not discretionary; non-compliance carries civil monetary penalties that start at $145 per violation and reach $2,190,294 per violation category per year at the highest tier (HHS inflation-adjusted amounts effective 28 January 2026), with criminal referrals possible in cases of willful neglect.

The HIPAA Breach Notification Rule, codified at 45 CFR §§ 164.400–414, establishes the full scope of these obligations. It applies to every covered entity, healthcare provider, health plan, and healthcare clearinghouse, and to every business associate that creates, receives, maintains, or transmits PHI on their behalf. Understanding exactly what triggers a reporting obligation, when it must be filed, and how the submission process works is foundational to any HIPAA compliance program.

What Is a Reportable HIPAA Breach?

A reportable HIPAA breach is any impermissible use or disclosure of protected health information that is not otherwise permitted under the Privacy Rule. Under the Breach Notification Rule, such a use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI has been compromised. The definition is intentionally broad: it covers accidental disclosures, insider misuse, ransomware attacks that encrypt PHI, misdirected emails, lost or stolen devices containing unencrypted records, and unauthorized third-party access, among many other scenarios.

PHI is defined under HIPAA as individually identifiable health information transmitted or maintained in any form, electronic, paper, or oral, that relates to an individual’s past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare. Combining a name with a diagnosis, a Social Security number with treatment records, or an account number with insurance information constitutes PHI. It is subject to the Breach Notification Rule when exposed without authorization.

A HIPAA breach is not limited to cyberattacks or external intrusions. An employee accessing a patient’s record out of curiosity, a fax sent to the wrong recipient, or a paper record left in an unsecured location can all constitute reportable breaches unless the low-probability-of-compromise test is met. The manner in which the breach occurred does not determine whether it is reportable; the nature of what was exposed and the risk it poses to the affected individual does.

Every HIPAA Breach Must Be Reported Unless…

HIPAA presumes that every impermissible use or disclosure of PHI is a reportable breach. That presumption can be rebutted, not assumed away, only through a documented four-factor risk assessment that shows a low probability that the PHI was compromised. This is one of the most consequential aspects of the Breach Notification Rule: the burden of proof sits entirely with the covered entity or business associate, not with the regulator.

The four factors the risk assessment must evaluate are: the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; the identity of the unauthorized person who used or accessed the PHI; whether the PHI was actually acquired or viewed, or whether there is a low probability this occurred; and the extent to which the risk to the PHI has been mitigated following the incident.

Beyond the four-factor assessment, HIPAA also carves out three specific categories of impermissible disclosure that are explicitly excluded from the definition of a breach. The first is an unintentional acquisition, access, or use of PHI by a workforce member acting in good faith within their scope of authority, provided the information is not further used or disclosed impermissibly. The second is an inadvertent disclosure by one authorized person to another within the same covered entity or business associate, again with no further impermissible use. The third is a disclosure where the covered entity or business associate has a good-faith belief that the unauthorized recipient could not reasonably have retained the information.

These exclusions are narrow and fact-specific. Organizations that broadly apply them without documentation to avoid notification obligations expose themselves to significant enforcement risk.

HIPAA Breach Reporting to HHS OCR, How to Use the Portal

All HIPAA breach reports to HHS OCR are submitted through the OCR Breach Reporting Portal, accessible at ocrportal.hhs.gov. The portal is the exclusive submission mechanism for covered entities and business associates; there is no paper alternative for electronic submissions, and reports sent by other means will not be accepted as compliant filings.

To submit a breach report, the covered entity or business associate must create an account on the portal if one does not already exist, then complete the structured submission form, which asks for the details listed under HIPAA Breach Reporting Form and Submission Process below. The portal also asks for a description of what the organization has done or plans to do to investigate the breach, mitigate harm, and prevent future occurrences.

For breaches affecting 500 or more individuals, the submission is posted publicly on the HHS OCR breach portal (see Reporting to HHS OCR above), so covered entities should prepare external communications before filing. For small breaches affecting fewer than 500 individuals, the annual log submission through the portal does not result in public posting by default.

HIPAA Breach Reporting Timeline for Large vs. Small Breaches

HIPAA’s Breach Notification Rule establishes a two-track reporting timeline based on the number of individuals affected, and determining which track applies is one of the first steps a covered entity must take after discovering a breach.

For breaches affecting 500 or more individuals, covered entities must notify HHS OCR, affected individuals, and, if the breach affects residents of a specific state or jurisdiction, prominent media outlets in that area, all within 60 days of discovering the breach. The 60-day window is a ceiling, not a target. HHS OCR has consistently stated that notification should occur as soon as reasonably possible, and that using the full 60 days as a default delay, rather than completing notification as soon as the investigation allows, is inconsistent with the spirit and intent of the rule.

For breaches affecting fewer than 500 individuals, the absolute longest a covered entity has to report to HHS OCR is 60 days after the end of the calendar year in which the breach was discovered. Affected individuals must still be notified within 60 days of discovery. This means a small breach discovered in January could be reported to HHS OCR as late as 1 March of the following year, while individual notification is still due within 60 days of the January discovery date.

Business associates must report breaches to the covered entity within 60 days of discovery, though business associate agreements routinely shorten this window to 10 or 30 days. The covered entity’s reporting timeline to HHS OCR and affected individuals runs from the date the covered entity discovered or should have discovered the breach, which, if the business associate delayed notification, can create a compliance gap the covered entity must bridge.

Notifying Affected Individuals Under HIPAA

HIPAA requires that notice to affected individuals be written in plain language and delivered by first-class mail to the individual’s last known address, or by email if the individual has agreed to receive communications electronically, and that agreement has not been withdrawn. The notice must contain five core elements: a brief description of what happened, including the date of the breach and the date of discovery; a description of the types of PHI involved; the steps individuals should take to protect themselves from potential harm; a brief description of what the covered entity is doing to investigate and mitigate the breach and prevent future occurrences; and contact information for individuals to ask questions or obtain additional information.

When a covered entity lacks sufficient contact information for 10 or more individuals, substitute notice is required. For those individuals, the covered entity must either post a conspicuous notice on its website for 90 days or provide notice to major print or broadcast media in the geographic areas where the affected individuals are likely to reside. A toll-free phone number that remains active for at least 90 days must be included in the substitute notice, giving individuals a direct channel to inquire whether their information was involved in the breach.

For breaches affecting 500 or more residents of a specific state or jurisdiction, media notification is required in addition to individual notice, not as a substitute for it. The media notice must go to prominent outlets in the relevant area within the same 60-day window that governs the HHS OCR submission and individual notifications.

HIPAA Breach Reporting Form and Submission Process

The HIPAA breach reporting form is embedded within the HHS OCR portal at ocrportal.hhs.gov and must be completed digitally; there is no standalone downloadable form for submitting large breach reports. The portal walks covered entities through a structured intake process that sequentially covers all required disclosure elements.

The information the form requires includes: the name, address, and contact information of the covered entity; the type of covered entity; the date the breach was discovered and, if known, the date it occurred; the approximate number of individuals whose PHI was involved; the type of breach, such as hacking, unauthorized access, theft, loss, or improper disposal; the location of the breached PHI, electronic medical records, paper records, portable devices, email systems, and so on; the type of PHI involved, demographic data, financial information, clinical information, and so on; the safeguards in place at the time of the breach; and a narrative description of the breach and the response measures taken.

Before submitting, covered entities should ensure that their breach risk assessment is fully documented and retained, that individual notification has been prepared and is ready for simultaneous release, and that any media notification requirements have been assessed. The portal submission is not the end of the compliance process; HHS OCR may open an investigation following any large breach submission, request additional documentation, and, in cases where systemic compliance failures are identified, initiate formal enforcement proceedings. Maintaining a complete breach response file, including the risk assessment, notification records, and internal communications, is essential preparation for that possibility.

GDPR Data Breach Reporting Requirements

GDPR data breach reporting requirements require data controllers to notify their supervisory authority within 72 hours of becoming aware of a personal data breach and to notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms. These obligations apply to any organization, regardless of its headquarters, that processes the personal data of individuals in the European Union.

The GDPR’s breach notification framework is established under Articles 33 and 34 of the regulation, and it represents one of the most demanding breach disclosure regimes in global privacy law. Unlike regulatory frameworks that focus primarily on sensitive data categories, GDPR’s notification obligation can be triggered by a breach involving any personal data, such as names, email addresses, IP addresses, or location data, provided the breach creates a meaningful risk of harm. The European Data Protection Board’s Guidelines 01/2021 on Examples of Personal Data Breach Notification provide the most detailed practical guidance on how supervisory authorities expect these obligations to be applied.

The 72-Hour Rule Under GDPR: What It Means in Practice

The 72-hour rule under GDPR requires data controllers to notify their lead supervisory authority within 72 hours of becoming aware that a personal data breach has occurred, not within 72 hours of confirming every detail of the breach, and not within 72 hours of completing an internal investigation. The clock starts at awareness, and it does not pause for investigation, legal review, or executive sign-off.

In practice, this means organizations need incident detection and internal escalation processes fast enough to deliver a credible initial assessment to a privacy officer or DPO within hours of identifying a breach, not days. The EDPB’s guidance acknowledges that organizations will rarely have complete information within 72 hours, and explicitly permits phased notification: an initial report filed within the deadline with the information available at the time, followed by supplementary filings as the investigation develops. The regulation does not permit using investigative incompleteness as a reason to delay filing the initial notification.

The 72-hour window is calculated in calendar hours, not business hours. A breach discovered at 11 pm on a Friday triggers a deadline of 11 pm on Monday, regardless of whether the supervisory authority’s offices are open. Organizations that limit breach response to business hours will routinely miss the deadline. This is one of the most operationally significant aspects of the rule, and it is why effective GDPR compliance requires a 24/7 incident response capability, or at minimum a clear escalation protocol that functions outside normal working hours.

When a controller fails to meet the 72-hour deadline, GDPR requires the notification to be filed as soon as possible, accompanied by a reasoned explanation for the delay. Supervisory authorities across the EU have made clear that reasons such as “we were still investigating” or “we were waiting for legal advice” are not automatically accepted as valid justifications, and that an ongoing internal investigation is not, in itself, sufficient to excuse a missed deadline. Repeated or systemic delays have led to enforcement action independent of the breach itself.

Reporting a Data Breach to Your DPA

Under GDPR, data controllers report personal data breaches to their lead supervisory authority, the Data Protection Authority of the EU member state in which the controller has its main establishment, defined as the place of its central administration in the EU. For organizations with establishments in multiple EU member states, the lead DPA is determined by where the controller’s central decision-making about data processing activities takes place. Controllers that are subject to the GDPR but have no establishment in the EU cannot use this one-stop-shop mechanism and generally must notify the supervisory authority of each member state where affected individuals are located.

Each EU member state’s DPA operates its own breach notification portal or submission process. In Ireland, for example, the Data Protection Commission receives breach notifications through its online portal. In Germany, notifications go to the relevant Landesbeauftragter für den Datenschutz (state-level DPA), depending on where the controller is established, since Germany’s DPA structure is federal rather than centralized. In France, notifications go to the CNIL. Controllers operating in the EU must identify their lead DPA before a breach occurs and ensure their incident response procedures align with that authority’s specific submission format and requirements.

The notification must contain, at minimum: the nature of the breach, including the categories and approximate number of individuals and personal data records involved; the name and contact details of the data protection officer or other point of contact; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects. If all of this information is not available within 72 hours, the controller submits what is known and provides a timetable for when further information will be available. The EDPB has confirmed that supervisory authorities prefer early, incomplete notifications to late, complete ones.

When Do You Need to Notify Data Subjects Under GDPR?

Notification to affected data subjects under GDPR is required when a breach is likely to result in a high risk to the rights and freedoms of natural persons. This is a higher threshold than the one that triggers a supervisory authority notification; not every breach that must be reported to a DPA also requires direct notification to the affected individuals.

A high risk to rights and freedoms means there is a significant probability that the breach will lead to physical, material, or non-material harm to the individuals whose data was involved. The EDPB identifies the following as indicators of high risk: identity theft or fraud, financial loss, damage to reputation, loss of confidentiality of data subject to professional secrecy, unauthorized reversal of pseudonymization, significant economic or social disadvantage, and any other substantial adverse effect on the individual. The more sensitive the data involved- health records, financial credentials, biometric data, data relating to children- the more likely the high-risk threshold is met.

When the high-risk threshold is met, notification to data subjects must be provided without undue delay; no fixed number of hours is specified for individual notification. Still, supervisory authorities expect it to follow the DPA notification closely, and any unreasonable delay will be scrutinized. The notice must communicate the nature of the breach, the contact details of the DPO or responsible contact, the likely consequences of the breach, and the measures taken or recommended to mitigate potential harm. It must be written in clear, plain language; legal boilerplate that obscures the practical implications for the individual is not compliant.

GDPR provides three circumstances in which individual notification can be waived even when a high-risk breach has occurred: where the controller has implemented appropriate technical measures, such as strong encryption, that render the data unintelligible to anyone who accessed it; where the controller has taken subsequent measures that ensure the high risk to data subjects is no longer likely to materialize; or where individual notification would involve disproportionate effort, in which case a public communication or equivalent measure must be used instead. Supervisory authorities assess these exemptions strictly, and controllers relying on them should retain detailed documentation of the technical measures and the reasoning behind them.

GDPR Breach Reporting When You’re a Processor vs. Controller

A data processor reports a personal data breach to the data controller, not to the supervisory authority. The GDPR’s breach notification obligations fall primarily on data controllers, the entities that determine the purposes and means of processing personal data. Data processors, entities that process personal data on behalf of a controller, have a different but equally important obligation that feeds directly into the controller’s ability to meet its own deadlines.

Under Article 33(2), a processor that becomes aware of a personal data breach must notify the controller without undue delay. No 72-hour window is specified for processor-to-controller notification; the phrase “without undue delay” sets the standard, and the EDPB’s guidance makes clear that this should be interpreted as immediate, or as close to immediate as circumstances permit. The urgency stems from a structural factor: the controller’s 72-hour clock to the DPA begins when it becomes aware of the breach, typically when the processor notifies it. Every hour the processor delays is an hour consumed from the controller’s regulatory deadline.

Contracts between controllers and processors, the Data Processing Agreements required under Article 28, typically specify a contractual notification deadline shorter than the one the GDPR prescribes. Deadlines of 24 hours or even 12 hours from processor discovery to controller notification are common in well-drafted DPAs, precisely because giving the controller maximum time to conduct its own assessment and meet the 72-hour window is in both parties’ interest.

Processors do not submit breach notifications directly to supervisory authorities; that obligation belongs exclusively to the controller. However, processors must assist controllers in meeting their notification obligations, which in practice means providing all relevant technical information about the breach, cooperating with the controller’s investigation, and making relevant personnel available to answer regulator questions if the controller’s DPA notification triggers an inquiry.

ICO Personal Data Breach Reporting, 72-Hour Guidance

The Information Commissioner’s Office is the UK’s data protection regulator and the supervisory authority for UK GDPR breach notifications following Brexit. UK GDPR mirrors the EU regulation’s 72-hour notification requirement, and the ICO has published detailed guidance, including a self-assessment tool and worked examples, to help organizations determine whether a breach is notifiable and how to file a compliant report.

The ICO’s breach reporting form is available on its website at ico.org.uk. Organizations must report breaches that are likely to result in a risk to individuals’ rights and freedoms, the same threshold as EU GDPR. The ICO has stated publicly that it receives thousands of breach reports annually and uses a risk-based approach to prioritize which to investigate further, but that being selected for investigation does not depend solely on breach severity; late, inadequate, or poor-quality notifications increase the likelihood of regulatory scrutiny.

The ICO’s guidance on the 72-hour window addresses several practically important scenarios. If an organization receives a credible report of a breach from an external source, a journalist, a third party, or a customer, and cannot immediately confirm or deny it, the ICO considers this a point of awareness that starts the clock. Organizations cannot avoid the 72-hour deadline by treating unconfirmed reports as outside the scope of notification obligations until internal verification is complete. The ICO expects organizations to begin their notification process based on reasonable belief, even while investigation continues.

The ICO also emphasizes that the quality of the initial notification matters. Reports that contain only minimal information, such as “we may have experienced a breach” with no description of the data or individuals involved, are treated as inadequate, even if they are technically filed within 72 hours. The ICO expects organizations to provide the best available information at the time of filing and to supplement it promptly as the investigation progresses.

Reporting a GDPR Breach Anonymously or Internationally

GDPR does not provide a mechanism for anonymous breach reporting to a supervisory authority. Article 33 requires that the notification include the name and contact details of the data protection officer or other point of contact; anonymity is structurally incompatible with the regulation’s accountability framework, which is built on the premise that the supervisory authority can follow up with the controller to request additional information, assess the response, and, if necessary, open an enforcement investigation.

This means organizations cannot report a GDPR breach to a DPA without identifying themselves, and individuals cannot file a GDPR breach notification on behalf of an organization. A data subject who believes their personal data has been breached can report their concern to their national DPA, which may then investigate the relevant controller, but this is a complaint mechanism, not a breach notification pathway.

For organizations operating internationally, particularly those with data subjects in both EU and non-EU jurisdictions, GDPR breach reporting runs parallel to, rather than replacing, other jurisdictional obligations. A breach affecting EU and US data subjects simultaneously triggers the GDPR’s 72-hour DPA notification requirement and the applicable US federal or state obligations for US data. These obligations are independent and must both be satisfied. The EDPB’s one-stop-shop mechanism means a controller with a single EU lead DPA can file one GDPR notification with that lead authority, which then coordinates with other concerned EU supervisory authorities; however, this applies only within the EU framework and does not reduce obligations under other jurisdictions’ laws.

Organizations subject to both GDPR and the UK GDPR, those with establishments or data subjects in both the EU and the UK, must notify both their EU lead DPA and the ICO when a breach affects individuals in both territories. Brexit created a dual-filing requirement that did not exist when the UK was an EU member state, and organizations that have not updated their breach response procedures to reflect this should treat it as a gap requiring immediate remediation.

Data Breach Reporting Requirements by Jurisdiction

Data breach reporting requirements vary significantly by jurisdiction; there is no single global standard, and most organizations operating across borders face overlapping obligations under multiple frameworks simultaneously. Where you are established, where your customers are located, and what type of data was compromised all determine which laws apply and which authorities must be notified.

The practical consequence of this jurisdictional complexity is that a single breach can trigger parallel notification obligations across federal regulators, state attorneys general, international supervisory authorities, and sector-specific bodies, each with different timelines, thresholds, and submission formats. Organizations that map these obligations in advance, rather than during an active incident, are substantially better positioned to meet every deadline without compounding a breach into a compliance failure.

US Federal Requirements (SEC, FCC, FERPA, HIPAA, CCPA, PCI)

The United States does not have a single federal data breach notification law. Instead, federal breach reporting obligations are distributed across sector-specific and issue-specific regulations, each governing a defined category of data or a defined class of organization. Understanding which federal frameworks apply to your organization, and how they interact, is the foundation of any US breach response plan.

HIPAA governs breaches of protected health information held by covered entities and their business associates, requiring notification to HHS OCR, affected individuals, and in some cases media outlets within 60 days of discovery. The SEC’s cybersecurity disclosure rules, effective December 2023, require publicly traded companies to report material cybersecurity incidents via Form 8-K within four business days of determining materiality. The FCC’s updated breach reporting rules require telecommunications carriers to notify the FBI, the Secret Service, and the FCC within 7 business days of determining that a breach of Customer Proprietary Network Information has occurred, with customer notification to follow within 30 days.

FERPA governs student education records at federally funded educational institutions. It does not prescribe a specific breach notification timeline or mandatory reporting pathway to a federal regulator; see Reporting to FERPA, FDA, and Other Sector-Specific Regulators above.

The Payment Card Industry Data Security Standard, PCI DSS, is a contractual framework rather than a law. Still, its breach notification requirements carry significant practical force for any organization that accepts, processes, or stores payment card data. Organizations that experience a breach involving cardholder data must notify their acquiring bank and the relevant card brands, Visa, Mastercard, American Express, and Discover, immediately upon suspecting a breach, often within 24 hours. The card brands then conduct their own forensic investigations, which are entirely separate from any regulatory notification obligation.

California’s breach notification statute applies to any business that owns or licenses computerized personal information of California residents. In contrast, the CCPA, as amended by the CPRA, applies to for-profit businesses that meet defined revenue or data volume thresholds. Since 1 January 2026, notification is due within 30 calendar days of discovery (see CCPA, California Breach Reporting Deadlines above), with enforcement by the California Attorney General and, under the CCPA, a private right of action for affected individuals when inadequate security leads to a breach.

Data Breach Reporting Requirements by State

Every US state, the District of Columbia, Puerto Rico, Guam, and the US Virgin Islands have enacted a data breach notification law, creating a patchwork of requirements that any organization handling personal information about US residents must navigate. According to the Identity Theft Resource Center, US organizations reported a record 3,322 data compromises in 2025, up from 3,152 in 2024, making state-level compliance more operationally consequential than ever. For a broader look at the year, see our roundup of data breaches in 2025.

The core elements that vary across state breach laws are: the definition of personal information that triggers notification, the notification deadline, who must be notified beyond affected individuals, and the required content of the notification. Most state laws define personal information as a name combined with a Social Security number, financial account number, driver’s license number, or similar government-issued identifier. An expanding group of states, including California, Colorado, Virginia, Connecticut, and New York, have extended their definitions to include health data, biometric identifiers, login credentials, precise geolocation, and genetic information.

Notification deadlines range from as few as 30 days after discovery, in states including California, Colorado, Florida, and Washington, to the more common standard of “in the most expedient time possible without unreasonable delay,” which leaves the number of days to the regulator or the courts. California requires notification to the California Attorney General, with a sample copy of the notice due within 15 days of notifying residents, when a breach affects more than 500 California residents. Texas requires businesses to notify the Texas Attorney General of breaches affecting 250 or more Texas residents within 30 days.

Organizations operating nationally must assess each breach against the most expansive state law applicable to any resident whose data was involved, not just the law of the state where the organization is headquartered. A breach affecting residents in 20 states may trigger 20 simultaneous, partially inconsistent notification obligations, each requiring individual tracking and documented compliance.

UK Data Breach Reporting (UK GDPR / ICO)

Following the United Kingdom’s exit from the European Union, the UK enacted its own version of the General Data Protection Regulation, UK GDPR, which came into force on 1 January 2021. UK GDPR retains the core structure and obligations of EU GDPR, including the 72-hour breach notification requirement, but operates as an independent legal framework enforced by the Information Commissioner’s Office rather than an EU supervisory authority.

The deadline, the reporting threshold, and the ICO’s online form are covered under UK GDPR / ICO, 72-Hour Reporting to the ICO and Reporting to the ICO (UK) above.

The ICO’s enforcement posture has become increasingly assertive. The ICO has issued fines under UK GDPR for late notification, inadequate security measures that enabled breaches, and failure to notify affected individuals when the high-risk threshold was met. Failures to notify fall under the standard maximum of £8.7 million or 2 percent of global annual turnover, whichever is higher, while infringements of the core data protection principles can reach £17.5 million or 4 percent, the same proportional ceilings as EU GDPR, translated into sterling.