Breach reporting

Vendor-neutral regime map for founders, CISOs, and incident commanders — whether a personal-data, sector, or product-vulnerability reporting duty might apply. Not legal advice. Does not start a clock.

Do I have to report a cybersecurity breach?

Whether reporting is mandatory depends on the regime: personal data, sector incident, or product vulnerability. GDPR, NIS2, DORA, CRA, California examples. Not legal advice.

Which reporting obligations might this incident trigger?

Walk a branching decision tree of data type, jurisdiction, sector, and threshold. Lists GDPR, NIS2, DORA, CRA, SEC, and HIPAA clocks that may apply. Not legal advice.

Which cybersecurity reporting deadline fires first?

Statute table of GDPR 72-hour, NIS2, DORA, CRA 24-hour/72-hour/14-day, SEC four-business-day, HIPAA 60-day, and California clocks. Not legal advice.

Who must be notified after a data breach?

Who to notify after a data breach: regulators, CSIRTs, individuals, customers, law enforcement, brands, insurers. Legal vs contractual vs best practice. Not legal advice.