Data Breach Response Guide: Notification Timelines and Legal Obligations (2025)
A data breach triggers simultaneous notification obligations across multiple regulators — often within 72 hours for GDPR, within 24-48 hours under enterprise DPA contractual terms, and within 30-60 days under HIPAA and state laws. Understanding which clock starts running when, and what each notification must contain, is the difference between an orderly response and an enforcement action.
Breach Notification Timeline Matrix
| Law / Rule | Who Notifies Whom | Deadline | Trigger |
|---|---|---|---|
| GDPR Art. 33 | Controller → Supervisory Authority | 72 hours from awareness | Any personal data breach (unless unlikely to result in risk) Staged notification permitted if info unavailable at 72h |
| GDPR Art. 34 | Controller → Individuals | Without undue delay | High risk to rights/freedoms of individuals Required for sensitive data, financial data, identity theft risk |
| GDPR Art. 33(2) | Processor → Controller | Without undue delay (DPAs often: 24-48h) | Any personal data breach affecting controller's data Must appear in DPA; processor does NOT notify supervisory authority directly |
| HIPAA Breach Notification Rule | Covered Entity → Individuals | 60 days from discovery | Unsecured PHI breach (unless risk assessment shows low probability) Written notification required; substitute notice for outdated contact info |
| HIPAA + HHS | Covered Entity → HHS | ≥500: 60 days; <500: annual (within 60 days of year end) | Same as individual notification trigger ≥500 affected: also notify prominent media in affected state/jurisdiction |
| HIPAA BA Agreement | Business Associate → Covered Entity | 60 days (most BAs: 24-48h in BAA) | Any PHI breach affecting covered entity's data BAA must specify notification requirements |
| CCPA / CPRA | Business → California residents | "Expedient and without unreasonable delay" | Unencrypted personal information accessed/acquired AG notification required if >500 CA residents affected; Free monitoring for SSN breaches |
| 50 US States | Business → Residents | 30-90 days (varies by state) | Unauthorized acquisition of personal information Must comply with shortest applicable deadline across all affected states |
Contract Risk — $97
Scan Your DPA for Breach Notification Obligations You May Have Missed
Upload your Data Processing Agreement or vendor contract and BizLegal AI identifies the contractual breach notification timelines you're bound by, gaps in your processor-to-controller obligations, missing IRP cooperation requirements, and liability allocation clauses for late notification — before a breach forces you to read the fine print under pressure.
Scan Your DPA for Breach Obligations →Frequently Asked Questions
What are the GDPR data breach notification deadlines and requirements?
Under GDPR Article 33, a controller that becomes aware of a personal data breach must notify the relevant supervisory authority (data protection authority) "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This is one of the most demanding breach notification timelines globally. What triggers GDPR breach notification: a "personal data breach" is defined broadly as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." This includes ransomware attacks (even if data isn't confirmed exfiltrated), accidental deletion, unauthorized access by employees, and phishing-induced credential compromise. The "awareness" clock: the 72-hour clock starts when the controller becomes aware — not when the breach occurred. This creates an obligation to monitor systems and investigate suspected breaches promptly, since delayed discovery does not extend the notification window once awareness exists. What the notification must include: (1) description of the nature of the breach, including categories and approximate number of data subjects affected and records involved; (2) name and contact details of the Data Protection Officer (or other contact point); (3) likely consequences of the breach; (4) measures taken or proposed to address the breach. If not all information is available at 72 hours, the notification can be made in phases — but the initial notification must still occur within 72 hours. Article 34 — notification to individuals: if the breach is likely to result in a "high risk to the rights and freedoms of natural persons," the controller must also notify the affected individuals "without undue delay." High risk includes breaches involving sensitive data, financial data, or data that could enable identity theft. Processors: under Article 33(2), data processors must notify the data controller "without undue delay after becoming aware of a personal data breach." This obligation must appear in your DPA. Processors do not notify supervisory authorities directly — that obligation falls to the controller. Exemptions: notification is not required if the breach "is unlikely to result in a risk to the rights and freedoms of natural persons" (low-risk breaches, e.g., a single record accidentally emailed to the wrong but trusted recipient who confirms destruction).
What are the HIPAA breach notification requirements for covered entities and business associates?
The HIPAA Breach Notification Rule (45 CFR Part 164) requires notification following the discovery of a breach of unsecured Protected Health Information (PHI). Different timelines apply depending on who is notifying and who they are notifying: (1) Covered entities → individuals: must provide written notification to each affected individual "without unreasonable delay and in no case later than 60 calendar days following the discovery of a breach." Method: first-class mail (or email with prior consent). If contact information is out-of-date for 10 or more individuals, a substitute notice (conspicuous posting on website for 90 days, or media notice) is required. (2) Covered entities → HHS: all breaches affecting 500 or more individuals must also be reported to HHS simultaneously (within 60 days). Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis (within 60 days of the end of the calendar year in which the breach was discovered). (3) Covered entities → media: breaches affecting 500 or more residents of a state or jurisdiction require notification to "prominent media outlets serving the state or jurisdiction" within 60 days. (4) Business associates → covered entities: business associates must notify covered entities of breaches "without unreasonable delay and in no case later than 60 calendar days of discovery of the breach." The covered entity then takes responsibility for notifying individuals. BA-to-CE notification requirements must appear in the Business Associate Agreement. The HIPAA risk assessment: before notification is required, covered entities must conduct a four-factor risk assessment: (a) nature and extent of PHI involved; (b) who accessed/used the information; (c) whether PHI was actually acquired or viewed; (d) extent to which risk has been mitigated. If the risk assessment concludes low probability of compromise, notification may not be required — but the analysis must be documented. HIPAA breach penalties: Tier 1 (unknowing violation): $100-$50,000 per violation, up to $1.9M per year. Tier 4 (willful neglect, not corrected): $50,000-$1.9M per violation, up to $1.9M per year. OCR has assessed multi-million dollar settlements against entities with systemic breach response failures.
What does a 72-hour data breach response playbook look like?
The first 72 hours after discovering a data breach are the most consequential for legal compliance, evidence preservation, and remediation. Hour 0–4 (immediate containment): (1) Isolate affected systems — take compromised servers offline or disconnect from network to prevent continued unauthorized access; (2) Preserve evidence — take forensic images of affected systems before remediation (evidence needed for regulatory investigation); (3) Change credentials — rotate all compromised credentials; revoke access tokens; (4) Notify internal incident response team — CISO, legal, DPO (if any), communications lead, and executive team; (5) Begin incident log — document every action with timestamp (required for regulatory reporting). Hour 4–24 (initial assessment): (1) Determine scope — what systems were affected, what data was accessed, how many individuals affected; (2) Identify breach trigger — ransomware? Phishing? Insider? Third-party compromise? (3) Identify applicable notification obligations — which jurisdictions' laws apply? Which frameworks? (GDPR, HIPAA, CCPA, state laws); (4) Engage forensic counsel — to direct investigation under attorney-client privilege; (5) Engage cyber insurance carrier — if cyber insurance is in place, notify promptly (late notice can void coverage); (6) Assess GDPR notification requirement — if EU personal data is involved, begin preparing supervisory authority notification for 72-hour deadline. Hour 24–72 (assessment + early notification): (1) Continue forensic investigation to quantify scope and confirm what was exfiltrated vs. merely accessed; (2) File GDPR supervisory authority notification if required (72-hour deadline from awareness); (3) Prepare individual notification letters (draft; may not send for 30-60 days depending on jurisdiction); (4) Notify business partners and vendors with relevant contractual notification obligations; (5) Brief board and executive team; (6) Evaluate whether law enforcement notification is appropriate (FBI, CISA for significant incidents). Post-72 hours: Follow HIPAA 60-day notification timeline; state breach notification timelines (typically 30-90 days); prepare HHS and media notifications if HIPAA covered entity with 500+ affected individuals; prepare regulatory enforcement response materials.
What are US state breach notification laws and how do they differ?
All 50 U.S. states (plus D.C., Puerto Rico, Guam, and the U.S. Virgin Islands) have enacted data breach notification laws. While there is no single federal breach notification law for most industries (HIPAA covers healthcare; the FTC Act applies broadly), state laws create a patchwork of obligations: Common elements across most state laws: (1) Trigger: "breach" typically defined as unauthorized acquisition of personal information — not just unauthorized access. Some states (including Connecticut and Indiana) have extended the trigger to unauthorized access even without confirmed acquisition. (2) Personal information definition: at minimum, name + SSN, driver's license, or financial account number. Most states have expanded to include: medical/health information; login credentials (username/password); biometric data; geolocation data; and passport numbers. (3) Notification to individuals: required if breach involves covered personal information; (4) Notification to state attorney general or regulator: many states require notification to the AG when breach affects more than a threshold number of residents (varies from 5 to 500). Key differences that create compliance complexity: (1) Timelines: California, Maine, Florida, Colorado: 30 days. New York (SHIELD Act): "expedient and without unreasonable delay" but within 90 days in certain cases. Texas: 60 days. Illinois, Indiana: 45 days. Ohio: 45 days. Montana: 30 days. Arizona: 45 days. Note: if a breach affects residents of multiple states, you must comply with the shortest applicable deadline. (2) AG/regulator notification: California requires notification to the AG if the breach affects more than 500 California residents; New York requires notification to the AG for any breach of NY residents; Florida requires AG notification within 30 days. (3) Free credit monitoring: some states (California, Delaware, Florida, Illinois) require offering free credit monitoring or identity theft protection services to affected individuals for breaches involving SSNs or similar data. (4) Exemptions: some states exempt entities already subject to equivalent federal requirements (e.g., HIPAA-covered entities in some states are exempt from separate state notification for PHI breaches). Federal preemption proposals: Congress has considered but not enacted a federal breach notification law that would preempt the patchwork of state laws. Until federal legislation passes, multi-state compliance remains required.
What breach notification obligations are contained in data processing agreements and vendor contracts?
Data processing agreements (DPAs), vendor contracts, and customer agreements routinely contain contractual breach notification obligations that are separate from and often more stringent than regulatory requirements. Key DPA breach notification provisions: (1) Processor-to-controller notification timeline: under GDPR Article 28 and equivalent contractual requirements, the processor (your vendor, or you as a vendor) must notify the controller "without undue delay" after becoming aware of a breach. Many enterprise DPAs specify contractual timelines shorter than the regulatory default: 24-48 hours is common in enterprise contracts vs. the GDPR "without undue delay" standard. Some contracts specify "immediately" or "within 24 hours" — these timelines can be extremely difficult to comply with if your incident response infrastructure is not pre-built. (2) Required notification content: DPAs specify the information that must be provided in the breach notification, mirroring Article 33 requirements: nature of the breach, categories and number of data subjects, categories and number of records, contact point, likely consequences, and mitigation measures taken. (3) Investigation cooperation: DPAs require the processor to provide full cooperation with the controller's investigation — including access to systems, logs, and personnel. Failure to cooperate can be grounds for immediate contract termination. (4) Liability for late notification: some DPAs specify that processor liability for regulatory fines attributable to late notification (controller fined because processor notified late) is indemnified by the processor. This is one of the most significant contractual risk allocations in data processing agreements. (5) Customer contract breach clauses: your customer MSA or service agreement likely includes breach notification obligations running to your customers — often requiring you to notify customers "promptly" or within a specified window (commonly 24-72 hours) if their data is involved in a breach. Check your customer contracts for: notification timeline; required content of notification; obligation to cooperate with customer's investigation; and whether breach of the notification clause constitutes a material breach entitling termination. Best practice for vendors: build a breach notification workflow that can consistently deliver processor-to-controller notification within 24-48 hours — the contractual window is typically shorter than the regulatory GDPR window, and customers lose trust when notification is slow.
What should a data breach incident response plan include to satisfy regulatory and contractual requirements?
A documented Incident Response Plan (IRP) is required under GDPR (as part of Article 32 technical and organisational measures), HIPAA (as part of the Security Rule administrative safeguards), PCI DSS (Requirement 12.10), and SOC 2 CC7.3/CC7.4 controls. Regulators treat absence of an IRP as an aggravating factor in breach enforcement. Core IRP components: (1) Incident classification matrix — defines what constitutes a "security incident" vs. a reportable "data breach" vs. a low-severity event requiring no notification. Classification determines which response procedures activate. (2) Breach response team — named roles and responsibilities: Incident Commander (owns coordination); Technical Lead (forensics + containment); Legal/DPO (regulatory notification strategy); Communications Lead (internal + external communications); Executive Sponsor. Includes escalation procedures and out-of-hours contact information. (3) 72-hour GDPR notification procedure — step-by-step guide for filing supervisory authority notification: which authority to notify (based on EU establishment or main data subjects), portal login credentials, required form fields, and who has authority to file. (4) Evidence preservation protocol — forensic image procedures before remediation; chain of custody for evidence; log retention requirements during investigation; documentation standards for regulatory submission. (5) Communication templates — pre-approved templates for: individual notification letters (GDPR, HIPAA, state law); supervisory authority notification; customer notification; board briefing; media statement. Pre-approval speeds execution under time pressure. (6) Vendor and third-party notification — list of all vendors and processors who must be notified in the event of a breach, with contractual timelines and contact information. (7) Post-incident review — mandatory post-mortem within 30 days of closure: root cause analysis, remediation verification, policy and control updates, regulatory submission review. (8) Testing and tabletop exercises — IRP must be tested at least annually through tabletop exercises simulating breach scenarios. HIPAA Security Rule requires testing; GDPR Article 32 requires "regular testing, assessing and evaluating." SOC 2 auditors require evidence of testing.