Breach reporting
Vendor-neutral regime map for founders, CISOs, and incident commanders — whether a personal-data, sector, or product-vulnerability reporting duty might apply. Not legal advice. Does not start a clock.
Do I have to report a cybersecurity breach?
Whether reporting is mandatory depends on the regime: personal data, sector incident, or product vulnerability. GDPR, NIS2, DORA, CRA, California examples. Not legal advice.
Which reporting obligations might this incident trigger?
Walk a branching decision tree of data type, jurisdiction, sector, and threshold. Lists GDPR, NIS2, DORA, CRA, SEC, and HIPAA clocks that may apply. Not legal advice.
Which cybersecurity reporting deadline fires first?
Statute table of GDPR 72-hour, NIS2, DORA, CRA 24-hour/72-hour/14-day, SEC four-business-day, HIPAA 60-day, and California clocks. Not legal advice.
Who must be notified after a data breach?
Who to notify after a data breach: regulators, CSIRTs, individuals, customers, law enforcement, brands, insurers. Legal vs contractual vs best practice. Not legal advice.
How do regulator, customer, and individual notices differ?
Regulator vs customer vs individual breach notice: who, threshold, clock-start, content, and channel. GDPR Arts. 33 and 34; HIPAA §§164.404–408. Not legal advice.
Which countries' breach laws might apply to this incident?
Walk establishment, targeting, data-subject location, processing location, and sector tests that decide which breach laws may attach. GDPR Art. 3. Not legal advice.
What must a regulatory incident report contain?
What a regulator incident report must contain: GDPR Art. 33(3) fields, CRA Art. 14 and NIS2 Art. 23 kept separate, phased reporting. Not legal advice.
What evidence should support a regulatory filing?
Evidence for a breach notification: logs, awareness timeline, scope, risk assessment, forensics, remediation. GDPR Art. 33(5) vs NIST 800-86. Not legal advice.
How do you document your reporting decision?
How to document a notify or no-notify decision: GDPR Art. 33(5) records all breaches even when you do not notify. Field list. Not legal advice.
What happens if you fail to report a cybersecurity incident?
Penalty maxima if you fail to report a data breach: GDPR Article 83 two tiers, NIS2 Article 34, HIPAA 160.404, SEC authority. Not typical fines. Not legal advice.
How do regulators determine whether you knew about an incident?
How GDPR 'became aware', EDPB reasonable-certainty, SEC materiality, and DORA awareness start clocks — not a product timestamp. Not legal advice.
When must you notify a GDPR personal data breach?
GDPR Art. 33: notify the supervisory authority within 72 hours of becoming aware. When individuals must be told, processor duties, records to keep.
When must you report a significant incident under NIS2?
NIS2 Article 23: 24-hour early warning, 72-hour notification, and one-month final report to the CSIRT or competent authority. Essential versus important. Not legal advice.
When must you report a DORA major ICT-related incident?
DORA Articles 18–19: major ICT-incident classification, then distinct initial, intermediate, and final reports to the competent authority. Not legal advice.
When must you report under CRA Article 14?
CRA Article 14: 24-hour early warning, 72-hour notification, 14-day final report to the CSIRT and ENISA. Applies from 11 September 2026. Not legal advice.
When must you notify a UK GDPR personal data breach?
UK GDPR Articles 33–34: notify the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware. PECR is separate. Not legal advice.
Which US state breach-notification laws might apply?
Breach-notification laws exist in all 50 states with different clocks, AG and credit-bureau notices. A representative table and a multi-state approach.
When must you file Form 8-K Item 1.05 for a cyber incident?
Form 8-K Item 1.05: disclose a material cybersecurity incident within four business days of the materiality determination, not discovery. Item 106 is annual. Not legal advice.
When must you notify a HIPAA breach?
HIPAA Breach Notification Rule: four-factor assessment, 60-day individual notice, HHS OCR 500+ vs <500 clocks, media notice, BA vs covered entity. Not legal advice.
When must you notify a PIPEDA breach of security safeguards?
PIPEDA: notify the OPC and individuals as soon as feasible if a breach creates a real risk of significant harm. Keep a record of every breach. Not legal advice.
When must you notify an eligible data breach?
Privacy Act Part IIIC: eligible data breach, 30-day assessment, OAIC and individual notice as soon as practicable. Not a 30-day notify clock. Not legal advice.
When must you report a CERT-In incident or a DPDP breach?
CERT-In: 6 hours from noticing a reportable cyber incident (in force since 27 June 2022). DPDP Rule 7 intimation is not in force until 13 May 2027. Not legal advice.
Which UAE, DIFC or ADGM regime applies to a breach?
Which UAE regime applies to a breach: federal PDPL, DIFC or ADGM, and how each sets its notification timing. Not legal advice.