The incident clock

Every reporting clock in the LexLint law library that an incident involving an agent can start: the incident and vulnerability duties of cybersecurity law and the breach duties of privacy law, by jurisdiction, each with the sentence that carries the clock, and the Open Secure AI Alliance's proposed SAFE timeline drawn on the same scale.

An incident involving an AGENT, a credential it leaked, a tool it misused, a system it took down, a person's data it exposed, starts clocks in the law of every jurisdiction where the affected systems and people are. None of those clocks was written for agents. They are the incident and vulnerability reporting duties of cybersecurity law and the breach notification duties of privacy law, and the law library holds them by jurisdiction, each with the sentence that carries the clock and a link to the primary source.

This page lists them, and it draws the notification timeline of the Shared AI Findings Exchange (SAFE), the incident-learning scheme the Open Secure AI Alliance (OSAA) published for comment in 2026, on the same scale, because a member of that scheme would be reporting to a regulator and to the scheme from the same incident. Nothing here says which report an organization must file. It says which clocks exist, who set them, and where the text is.

1The proposal's timeline, and the statutory clocks beside it

The proposal's notification timeline sets six dated rungs and one recurring duty, quoted here as the proposal writes them (source: the SAFE proposal, read 18 September 2026). Beside each rung are the statutory clocks in the law library that fall at or inside it: later than the proposal's previous rung, no later than this one. The first rung has no hours, so what sits there is every obligation stated as a standard rather than a number.

2Security law: incident and vulnerability reporting, by jurisdiction

92 instruments in 65 jurisdictions in the law library's cybersecurity topic under its incident-reporting family state a reporting deadline, as of 21 October 2026: 70 a numeric clock, and 22 a standard such as "immediately" or "without undue delay" with no number. Most bind the OPERATOR of a service inside the scope of the NIS2 Directive or its national transposition; the CRA binds the MAKER of a product with digital elements, software included. The sentence says which.

9 more instruments in this family state no deadline in their obligation lines and are not listed here; the cybersecurity law section has them.

European Union Show the 9 provisionsHide the 9 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
European Union	Commission Delegated Regulation (EU) 2022/1645, External Reporting of Information Security Incidents and Vulnerabilities (IS.D.OR.230) (Commission Delegated Regulation (EU) 2022/1645, IS.D.OR.230) 72 hoursSubmit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)). Status since 16 Oct 2025Read from the law library 10 October 2026
European Union	Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Information Sharing on Cyber-Attacks and Threats (Commission Delegated Regulation (EU) 2024/1366, Art. 38) 4 hoursShare relevant information related to a reportable cyber-attack with your CSIRTs and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)). without undue delayProvide your CSIRTs without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)). Status since 13 Jun 2024Read from the law library 10 October 2026
European Union	Commission Implementing Regulation (EU) 2023/203, External Reporting of Information Security Incidents and Vulnerabilities in Aviation (IS.I.OR.230) (Commission Implementing Regulation (EU) 2023/203, IS.I.OR.230) 72 hoursSubmit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)). Status since 22 Feb 2026Read from the law library 10 October 2026
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations (Regulation (EU) 2024/2847, Art. 14) 24 hours72 hours14 daysNotify the CSIRT designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided. 24 hours72 hours1 monthNotify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the CSIRT an intermediate report on relevant status updates if it asks for one. Status since 11 Sep 2026Read from the law library 12 October 2026
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301 (Regulation (EU) 2022/2554, Article 19) 4 hours24 hoursReport a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it. 4 hoursWhere classification as major comes later than that, submit the initial notification within four hours of the classification instead. 72 hoursSubmit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities. 1 monthSubmit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures. without undue delayIf you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report. Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level. without undue delayNotifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable. Status since 17 Jan 2025Read from the law library 20 September 2026
European Union	EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure (Commission Implementing Regulation (EU) 2024/482, Arts. 35 and 39) without undue delayTransmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)). Status since 27 Feb 2025Read from the law library 10 October 2026
European Union	European Health Data Space Regulation, Serious-Incident Reporting by Manufacturers of EHR Systems (Regulation (EU) 2025/327, Art. 44(7)) 3 daysMake the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)). Status from 26 Mar 2029, in 2.4 yearsRead from the law library 10 October 2026
European Union	NIS2 Directive, Reporting Obligations (Directive (EU) 2022/2555, Art. 23) 24 hours72 hours24 hours1 month1 monthNotify your CSIRT, or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling. without undue delayWhere appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take. Status since 18 Oct 2024Read from the law library 7 October 2026
European Union	eIDAS Regulation, Article 19a(1)(b): Notification of Security Breaches and Disruptions by Non-Qualified Trust Service Providers (Regulation (EU) No 910/2014, Article 19a(1)(b)) 24 hoursMake each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)). Status since 20 May 2024Read from the law library 10 October 2026

EU member states (the national layer) Show the 39 provisionsHide the 39 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Austria	Netz- und Informationssystemsicherheitsgesetz (NISG), Incident Notification Obligations (NISG, BGBl. I Nr. 111/2018, §§ 19 und 21) without delayNotify your competent Computer-Notfallteam (CERT), or, absent one, the national CERT or GovCERT, without delay of a security incident affecting the service you provide. Status since 29 Dec 2018 replacedRead from the law library 3 October 2026
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations (NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35) 24 hoursNotify your competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident: an early warning within 24 hours of becoming aware, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects. 72 hoursFollow with a fuller notification within 72 hours of becoming aware, updating the early warning with an initial evaluation of the incident's severity and impact and any indicators of compromise. 1 month72 hours1 monthSubmit an interim report on request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report no later than one month after you have finished handling the incident (Section 34(2)). 24 hoursIf you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant cybersecurity incident that affects your trust services (Section 34(2)). Status since 1 Oct 2026Read from the law library 3 October 2026
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations (Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 34-37) without undue delayNotify the national CSIRT of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre. 24 hoursSubmit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise. 1 monthSubmit an interim report if the national CSIRT or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact. 1 monthIf the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5). 24 hoursIf you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2). Status since 18 Oct 2024Read from the law library 14 September 2026
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) (Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026)) 24 hours72 hours24 hours1 month1 monthNotify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)). 72 hoursState in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect. without undue delayWhere appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature. Status since 17 Feb 2026Read from the law library 15 September 2026
Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations (Art. 35B of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025) 6 hoursNotify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available. 1 month15 daysSubmit an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every fifteen days, and a final report within fifteen days of restoring the affected network or information system's normal operation). 24 hoursWhere you are a trust service provider, notify within 24 hours rather than 72 for a significant incident affecting the trust services you supply. without undue delayWhere applicable, notify without undue delay the recipients of your services who may be affected by a significant cyber threat, of any measures or corrective action they can take, and notify them of a significant incident likely to adversely affect their use of the service. Status since 25 Apr 2025Read from the law library 16 September 2026
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification (Act No. 264/2025 Coll., Cybersecurity Act, Sections 15-16) 24 hoursIf you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact. 24 hoursIf you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision. 72 hoursFor an incident with significant impact, follow with a report no later than 72 hours after detection that updates your initial assessment and gives the incident's impact and, where available, indicators of compromise. 24 hoursIf you provide a trust service under the directly applicable EU regulation, submit the notification of an incident with significant impact within 24 hours after detection, not 72. 30 days72 hours30 daysSubmit an interim report on request, and a final report no later than 30 days after the 72-hour report, or, if the incident is still ongoing at that point, a progress report followed by a final report within 30 days of resolution. Status since 1 Nov 2025Read from the law library 14 September 2026
Germany	BSI-Gesetz (BSIG), Incident Notification (BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8(1) of the Act of 23 July 2026 (BGBl. 2026 I Nr. 226), § 32) 24 hoursNotify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect. 72 hoursFollow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 month72 hoursSubmit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it. Status since 6 Dec 2025Read from the law library 12 September 2026
Denmark	Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Significant Incident Notification (Lov nr. 435 af 6. maj 2025, §§ 8, 9 og 11) 24 hours72 hours1 month1 monthNotify the Danish Agency for Societal Security and the CSIRT of every significant incident: an early warning without undue delay and within 24 hours of becoming aware of it, stating whether it is suspected to be caused by unlawful or malicious acts or could have a cross-border effect; an incident notification within 72 hours; an interim report when the authority asks; and a final report within one month of the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Sections 8(2) and 9(1)). without undue delayTell the recipients of your services, without undue delay and to the relevant extent, when a significant incident is likely to affect their service negatively, and tell recipients potentially affected by a significant cyber threat of any measures they can take in response (Section 11). Status since 1 Jul 2025Read from the law library 12 October 2026
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties (NIS 2-loven, §§ 12-13, 15) 24 hoursSend an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect. 72 hoursFollow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available. 1 month1 monthSubmit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled. 24 hours72 hoursIf you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours. without undue delayNotify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant. Status since 1 Jul 2025Read from the law library 15 September 2026
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident (Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1) 24 hoursSubmit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority. 24 hoursWhere you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1). 72 hours24 hoursFollow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a trust service provider, in which case you submit it within 24 hours instead. 1 month1 monthSubmit an interim report if RIA asks for one, and a final report within one month of the incident report, or, if the incident is still unresolved at that point, treat that report as interim and submit a further final report within one month of resolution. Status since 1 Jan 2026Read from the law library 7 October 2026
Spain	Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting Obligations (Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555)) 24 hoursAs drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)). 72 hours24 hoursAs drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)). 1 month1 monthAs drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)). as soon as possibleAs drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take. Status proposedRead from the law library 12 September 2026
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation (Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero) without undue delayNotify the competent authority, through your reference CSIRT, without undue delay, of an incident that may have a significant disruptive effect on the provision of your service, whether on your own networks or a third-party provider's. 24 hours48 hours20 days72 hours40 daysFor a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6). Status since 9 Sep 2018Read from the law library 12 September 2026
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations (Kyberturvallisuuslaki (124/2025), 11-14 ja 22 §) without delayNotify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage. 24 hours72 hours24 hoursFile an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72. 1 month1 month1 monthProvide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects. without delayNotify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it. Status since 8 Apr 2025Read from the law library 15 September 2026
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances (90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023)) without delayNotify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks you use that may significantly endanger the use of information systems or the provision of social and health care services; a pharmacy whose operations may be significantly endangered also notifies the Finnish Medicines Agency without delay (section 90). Status since 1 Jan 2024Read from the law library 12 October 2026
Finland	Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators (274 ja 275 §, Laki sähköisen viestinnän palveluista (917/2014)) without delayIf you are a telecommunications operator (teleyritys) providing a communications service in Finland, notify your subscribers and users without delay when a significant information-security breach, or another event that prevents the service from working or materially disturbs it, affects or threatens your service (Act 917/2014, section 274). without delayIf you provide a value-added service as a value-added service provider (lisäarvopalvelun tarjoaja), notify your users without delay of a significant information-security breach, or the threat of one, affecting your service (section 274). without undue delayAs a telecommunications operator, notify the Finnish Transport and Communications Agency without delay of the same kind of breach or event, then report without undue delay its estimated duration and effects, the corrective measures taken and the measures taken to prevent it recurring (section 275). Status since 1 Jan 2015Read from the law library 12 October 2026
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification (Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13) without delayDeclare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider). Status since 10 May 2018Read from the law library 12 September 2026
France	Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2) (Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents)) 24 hours72 hours1 month1 month1 monthIn the text the Sénat adopted, notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours of becoming aware of it updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month of the intermediate notification, or, where the incident is not yet handled by then, a progress report within one month of the intermediate notification and a final report within one month of the incident being handled (Article 17). 24 hours72 hours1 monthIn the text the Assemblée nationale's special committee deposited (n° 1779-A0), the initial notification within 24 hours, the intermediate notification within 72 hours and the final report within one month would be the same, but an incident would count as important only where it caused or is liable to cause a severe operational disruption or significant financial losses for you, or considerable material, physical or non-material damage to another person. without undue delayIn that committee text, where appropriate, notify the recipients of your services without undue delay of an important incident with a direct impact on them and of the measures or corrections they can apply against a critical vulnerability, and also inform them of the vulnerability itself, except for information whose disclosure would harm the interests of defense and national security. 24 hoursWhere you are a qualified trust-service provider (Article 8(4)) or a trust-service provider (Article 9(3)), send the intermediate notification within 24 hours rather than 72 for an incident affecting your trust services. Status proposedRead from the law library 12 October 2026
Greece	Law 5160/2024, Significant-Incident Reporting Obligations (Law 5160/2024 (Ν. 5160/2024), Art. 16) 24 hoursNotify the CSIRT of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects. 72 hoursFollow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects. 1 month72 hours1 monthSubmit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution. 24 hours72 hoursIf you are a trust-service provider, notify the National Cybersecurity Authority of a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour notification. without undue delayWithout undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response. Status since 27 Nov 2024Read from the law library 15 September 2026
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations (Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85.) 24 hours24 hours72 hours30 days30 daysNotify the competent CSIRT of every significant incident on this clock, set by the Cybersecurity Regulation rather than the Act itself: an early warning without delay and no later than 24 hours after becoming aware of it (24 hours also for a trust service provider's initial notification), an initial notification no later than 72 hours otherwise, an interim report if the CSIRT requests one, and a final report no later than 30 days after your initial notification, or, if the incident is still unresolved at that point, a progress report instead, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of your last progress report. 7 daysSubmit an interim report to the CSIRT when it requests one, within the period the CSIRT sets, of no less than 48 hours and no more than seven days from receipt of the request. 72 hours72 hoursNotify the recipients of your service, without delay and no later than 72 hours after you become aware of a significant incident likely to affect them, in a clear and easily verifiable way, and send them any details that were not yet known within 72 hours of sending that notice. Separately notify them of a serious cyber threat and of any protective measures or remedies they can take. 30 daysIf you are newly categorized as an essential or important entity, you have 30 days from the date you receive your Article 19(1) categorization notice before these notification duties bind you. Status since 30 Nov 2024Read from the law library 16 September 2026
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine (2024. évi LXIX. törvény, 66. §; 418/2024. (XII. 23.) Korm. rendelet, 42. § és 77. §) 24 hours72 hours1 monthNotify the national cybersecurity incident-handling center (Nemzeti Kiberbiztonsági Intézet, the NKI) of a cyber threat, near-incident or cybersecurity incident affecting your electronic information system: an initial notification without undue delay and in any case within 24 hours of becoming aware, an event notification without undue delay and in any case within 72 hours of becoming aware that updates that report and assesses the incident's severity and impact, and a final report no later than one month after the event notification. 24 hoursIf you are a trust service provider, notify the center of a cybersecurity incident affecting your trust services without undue delay and in any case within 24 hours of becoming aware of it, in place of the event notification (Decree 418/2024, Section 77(4)). 1 monthSubmit an interim status report if the center asks for one, and, if the incident is still ongoing when the final report is due, a report on the results achieved so far followed by a final report within one month after you have finished handling the incident (Decree 418/2024, Section 77(1)). Status since 1 Jan 2025Read from the law library 12 October 2026
Ireland	European Union (NIS) Regulations 2018, Incident Notification (S.I. No. 360/2018, Regs. 18 and 22) 72 hoursNotify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on. 72 hoursNotify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)). Status since 18 Sep 2018Read from the law library 12 September 2026
Ireland	National Cyber Security Bill, Incident Response Powers and Reporting Obligations (Head 15, General Scheme, National Cyber Security Bill 2024) 24 hours72 hours1 monthNotify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15). 1 monthWhere the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15). 24 hoursIf you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15). Status proposedRead from the law library 12 September 2026
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification (D.Lgs. 4 settembre 2024, n. 138, Art. 25) 24 hoursNotify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact. 72 hoursFollow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 month1 monthSubmit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution). 24 hoursWhere you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply. Status since 16 Oct 2024Read from the law library 12 September 2026
Italy	Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties (Artt. 1 e 2, Legge 28 giugno 2024, n. 90) 24 hours72 hoursIf you are a central public administration, region, metropolitan city, large municipality or regional capital, urban or suburban public transport company, local health authority, or an in-house company providing IT, transport, wastewater or waste services for them, report any incident on the ACN taxonomy that affects your networks, information systems or IT services without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment (Law 90/2024, Article 1(1) and (2)). 15 daysIf ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2). Status since 17 Jul 2024Read from the law library 12 October 2026
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification (Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of 11 July 2024, in force since 18 October 2024, and amended by Nr. XV-894 of 12 May 2026 and Nr. XV-1076 of 25 June 2026 (consolidated edition of 4 July 2026), Art. 18) 24 hoursNotify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it. 72 hours72 hours24 hoursFollow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning. 1 monthSubmit a final report within one month of the day you submitted the incident notification, and an interim report on NKSC's request. Status since 18 Oct 2024Read from the law library 7 October 2026
Luxembourg	Loi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability Notices (Art. 1, 5 et 6, Loi du 20 décembre 2024 (Mémorial A n° 604)) 72 hoursIf you hold a European cybersecurity certificate, issue an EU declaration of conformity, or are a conformity assessment body, inform ILNAS in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements linked to the certification of a product, service or process (Loi du 20 décembre 2024, Article 5(2)). 72 hoursIf you are an accredited conformity assessment body, inform ILNAS of your accreditation and of the certificates you issue within 72 hours (Article 6). Status since 31 Dec 2024Read from the law library 12 October 2026
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification (Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14) without undue delayNotify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person. 24 hoursSubmit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect. 72 hoursFollow with a fuller incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 month72 hours1 monthSubmit an intermediate report if a CSIRT or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4). without undue delayWhere appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat. 24 hours72 hoursIf you are a trust-service provider, notify a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour incident notification; the early warning, the intermediate report and the final report still apply. Status since 10 May 2026Read from the law library 14 September 2026
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation (Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti) 5 business daysWhere you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential. Status since 1 Sep 2024Read from the law library 7 October 2026
Latvia	Nacionālās kiberdrošības likums, Incident Notification (Nacionālās kiberdrošības likums (adopted 20.06.2024, notification clock applying from 01.07.2025), 34. pants) immediatelyImmediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (for most private-sector and civilian public-sector subjects, the Institute of Mathematics and Computer Science of the University of Latvia), and follow its instructions. 24 hoursFor a significant cyber incident, electronically submit an early warning to the competent institution without delay and no later than within 24 hours. 72 hours24 hoursFollow with an initial report within 72 hours (within 24 hours instead, if you are a trust service provider). 1 monthWithin one month of the initial report, submit a final report on the incident's resolution, or, if it is still unresolved at that point, a progress report followed by a final report once you have resolved it; submit an intermediate report if the competent institution requests one. immediatelyWhere relevant, immediately inform your service recipients, including affected network or system users, of protective measures they can take, and, after coordinating with the competent institution, inform them of the significant incident or threat itself, unless disclosure would create a new significant-incident risk or conflict with national security. Status since 1 Jul 2025Read from the law library 7 October 2026
Malta	Electronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications Authority (L.N. 379 of 2021, reg. 28, Electronic Communications Networks and Services (General) Regulations) without undue delayNotify the Authority, the Malta Communications Authority, without undue delay of any security incident that has a significant impact on the operation of your networks or services (regulation 28(2)(a)). without undue delayIf you are a gateway operator, notify the Authority without undue delay of any failure or serious degradation of the connectivity you provide (regulation 28(2)(b)). Status since 1 Oct 2021Read from the law library 12 October 2026
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches (Malta Gaming Authority Directive 3 of 2018, Gaming Authorisations and Compliance Directive, art. 37(2)(c) and (d)) 3 business daysNotify the Authority forthwith, and in any case no later than three working days after the breach, of any breach of your information security that adversely affects the confidentiality of information relating to players (article 37(2)(c)). 12 hoursNotify the Authority on the same clock of any breach of your information security that precludes players from accessing their accounts for a period exceeding twelve hours (article 37(2)(d)). Status since 1 Aug 2018Read from the law library 29 September 2026
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT (S.L. 460.41, art. 20, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order) immediatelyNotify the national CSIRT, which article 8(1) establishes within the Malta Information Technology Agency, immediately of any incident that has a significant impact on the provision of your services; treat an incident as significant where it has caused or is capable of causing severe operational disruption of the service or financial loss for you, or considerable material or non-material damage to another person. 24 hoursSubmit an early warning to the national CSIRT, without undue delay and in any event within 24 hours of becoming aware of the significant incident, stating where applicable whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours of becoming aware of the incident, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, the indicators of compromise. 1 month1 monthSubmit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it. without undue delayWhere appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response. 24 hours72 hoursIf you are a trust service provider, notify a significant incident that affects your trust services within 24 hours of becoming aware of it, without the 72-hour stage that applies to other entities. Status since 23 Jan 2026Read from the law library 29 September 2026
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations (Cyberbeveiligingswet, Artt. 25-29) 24 hoursGive your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects. 72 hours24 hoursFollow with a notification, without delay or, if that is not possible, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident's severity and effects. If you provide a trust service and the incident affects its provision, file this notification without delay or, if that is not possible, within 24 hours of becoming aware of the incident instead. 1 month1 monthSubmit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution. Status since 15 Aug 2026Read from the law library 12 September 2026
Poland	Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych (Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)) 24 hoursNotify the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning. 72 hours1 month72 hoursFollow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification. 24 hoursIf you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)). 1 monthIf the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b). Status since 3 Oct 2026Read from the law library 14 September 2026
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations (Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º) 24 hours72 hoursSubmit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below. 24 hoursSubmit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending. 30 business daysSubmit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)). Status since 3 Apr 2026Read from the law library 15 September 2026
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification (Ordonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17) without undue delayReport to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC). 6 hoursReport to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)). 24 hours72 hours1 month72 hoursSubmit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the CSIRT requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point. 24 hoursIf you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock. Status since 31 Dec 2024Read from the law library 15 September 2026
Sweden	Cybersäkerhetslag, Incident Notification (Cybersäkerhetslag (2025:1506), 2 kap. 5-10 §§) 24 hoursInform the authority the government designates (in practice the CSIRT-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it. 24 hours72 hoursFollow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware. 1 month1 monthNo later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it. Status since 15 Jan 2026Read from the law library 15 September 2026
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations (Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 29-30) 24 hoursGive your competent CSIRT group an early warning without delay, at latest within 24 hours of detecting a significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect. 72 hours1 month72 hours1 monthFollow with a full notification without delay, at latest within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available threat indicators, then an interim report if the CSIRT group asks for one, and a final report at latest one month after the 72-hour notification, or a progress report and a final report within one month of resolution if the incident is still ongoing at that point. 24 hoursIf you are a trust service provider, notify your competent CSIRT group of a significant incident affecting your services without delay, and at latest within 24 hours of detecting it, instead of waiting for the full notification (Article 30, paragraph 2). without delayWithout delay, inform the recipients of your services of a significant incident likely to adversely affect them, and communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response. Status since 19 Jun 2025Read from the law library 15 September 2026
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification (Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., § 24 a § 5 ods. 5) 24 hoursReport without undue delay, and no later than 24 hours after becoming aware of it, an early warning of a significant cyber security incident, stating in particular whether it may have been caused by unlawful conduct or may have a cross-border effect. 72 hoursNo later than 72 hours after becoming aware of it, report a notification updating and completing the early warning, in particular an initial assessment of the incident's severity and impact. 24 hoursIf you are also a trust service provider, report a significant cyber security incident, with its effect on your trust services, without undue delay and no later than 24 hours after discovering it, in place of the later notification (Section 24(3)(b)). 1 month72 hoursNo later than one month after the 72-hour notification, report a final report describing the incident, its severity and impact, the threat type or probable root cause, the mitigating measures taken and under way, and any cross-border impact. 30 days30 daysWhere an incident with cross-border impact is still ongoing when the final report is due, report an updated final report within 30 days of restoring normal network and system operation; where any significant incident is still ongoing when you submit the final report, report further information and an updated final report within 30 days of its resolution. Status since 1 Jan 2025Read from the law library 15 September 2026

United States, federal Show the 4 provisionsHide the 4 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
United States	Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers (12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC)) 36 hoursIf your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred. A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock. as soon as possibleIf your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more. This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within. Status since 1 May 2022Read from the law library 20 September 2026
United States	Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (6 U.S.C. 681-681g (CIRCIA)) 72 hoursOnce the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred. 24 hoursOnce the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident. promptlyOnce the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes. Status from a date not yet setRead from the law library 20 September 2026
United States	SEC Cybersecurity Risk Management, Governance, and Incident Disclosure (Regulation S-K Item 106; Form 8-K Item 1.05) (17 CFR 229.106; 17 CFR 249.308 (Form 8-K Item 1.05)) 4 business daysIf your organization is an SEC reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination. 4 business daysIf the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available. Status since 18 Dec 2023Read from the law library 18 September 2026
United States	Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012) (48 CFR 252.204-7012) 72 hoursRapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report. Status since 26 Aug 2015Read from the law library 20 September 2026

United States, states Show the 1 provisionHide the 1 provision

Jurisdiction

Instrument, and the obligation lines that carry a clock

New York

New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent (23 NYCRR 500.17) 72 hoursNotify the Superintendent electronically, in the form set forth on the Department's website, as promptly as possible but no later than 72 hours after you determine that a Cybersecurity Incident has occurred at your organization, an affiliate, or a third-party service provider: an event that requires notice to a government or supervisory body, that has a reasonable likelihood of materially harming a material part of your normal operations, or that results in the deployment of ransomware within a material part of your information systems. promptlyPromptly provide the Superintendent any information requested about a reported incident, and continue updating the Superintendent with material changes or new information previously unavailable; the regulation states no separate numbered clock for either duty. 24 hours30 daysWhere you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules. Status in forceRead from the law library 20 September 2026

Asia and the Pacific Show the 9 provisionsHide the 9 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident (Cyber Security Act, 2026 (Act No. 81 of 2026), s. 9) without delayWithout delay after a cyber incident occurs, inform the National Computer Emergency Response Team the National Cyber Security Agency maintains; the Act names no fixed number of hours or days for this notification. Status since 21 May 2025Read from the law library 18 September 2026
China	Data Security Law, Risk Monitoring and Incident Reporting Duty (Data Security Law of the People's Republic of China, Art. 29) immediatelyOn an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness. Status since 1 Sep 2021Read from the law library 12 September 2026
China	National Cybersecurity Incident Reporting Measures (Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued September 11, 2025), Arts. 2, 4, 5, 8, 9, 12, 14) 1 hourWhere the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident. 2 hoursWhere you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident. 4 hoursEvery other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident. promptlyWhere your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly. promptlyWhere an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer. 30 daysWithin 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report. Status since 1 Nov 2025Read from the law library 20 September 2026
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty (Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3)) immediatelyReport the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy. Status since 10 Oct 2019Read from the law library 16 September 2026
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation (Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022)) 6 hoursReport a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, or an attack through a malicious or fake mobile app, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website. Status since 27 Jun 2022Read from the law library 12 September 2026
Kyrgyzstan	Digital Code, digital resilience incident notification (Digital Code, Law No. 178, Art. 63) 72 hoursNotify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice. 48 hoursIf you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it. Status since 6 Feb 2026Read from the law library 18 September 2026
South Korea	Information and Communications Network Act, Report on Computer Security Incidents (Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024)) immediatelyImmediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated. Status since 10 Jun 2022Read from the law library 12 September 2026
Uzbekistan	Law on Cybersecurity, cybersecurity incident notification duty (Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 22-24) as soon as it occursNotify the State Security Service of any cybersecurity incident or cybercrime affecting your information systems or resources as soon as it occurs; the statute sets no numeric deadline or severity threshold. Status since 17 Jul 2022Read from the law library 18 September 2026
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties (Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4)) immediatelyWhen a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report. Status since 1 Jul 2026Read from the law library 16 September 2026

Africa Show the 16 provisionsHide the 16 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification (Code du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 148 et 149)) 24 hoursNotify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores. 24 hoursWhere the breach or loss of integrity is liable to harm a user of the service, notify that user as well, within twenty four hours. Status since 13 Mar 2023Read from the law library 19 September 2026
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI (Décret n°2021-917 du 22 décembre 2021, Arts. 16-17) immediatelyInform ARTCI immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning. Status since 22 Dec 2021Read from the law library 18 September 2026
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting (Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Septième, Art. 747) without delayReport a serious information-system security incident to the cybersecurity authority without delay, if you access data in Djibouti's national health data system as a health professional, health establishment, health-insurance financing body, or other body accessing that system. immediatelyExpect a significant security incident to be separately and immediately transmitted by the national authority in charge of information systems to the State's competent authorities. Status in forceRead from the law library 19 September 2026
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content (Computer Crime Proclamation No. 958/2016, art. 2(13), art. 2(19), art. 17, art. 27, art. 46) immediatelyImmediately notify the Information Network Security Agency (now the Information Network Security Administration) and report the crime to the police, and take appropriate measures. Status since 7 Jul 2016Read from the law library 19 September 2026
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT (Critical Infrastructure Cybersecurity Proclamation No. 1426/2026, art. 7(14), art. 9(2), art. 22(1)(b)-(c), art. 22(2)-(3), art. 22(5), art. 25(1)(b), art. 25(2)-(4), art. 28) 48 hoursNotify the National Computer Emergency Response Center of a cyber incident within 48 hours of becoming aware of it, using the system the Administration establishes, and implement the mandatory recommendations or directions the Center provides within the time it sets. 48 hoursFailing to notify an incident within 48 hours, or to take appropriate corrective action, is an administrative offense fined from 1,500,000 to 2,000,000 Birr; failing to provide the requested information or cooperation during a cyberattack response is fined from 300,000 to 500,000 Birr; a negligent violation of either is fined at no more than half the stated amount, a first violation causing no damage may be resolved with a written warning instead, and a repeat violation is fined at triple the stated maximum. 48 hoursAn officer, employee, member of the management body, or owner of the critical infrastructure who intentionally fails to notify the Center within 48 hours, or to take appropriate corrective action, is separately subject to imprisonment of up to one year; where that failure interrupts, disrupts, or damages the critical infrastructure's service, compromises its integrity or confidentiality, or harms national security, national interest, public health, life, or the environment, the term rises to rigorous imprisonment of seven to ten years, or three to five years where the aggravated result is caused negligently. Status from 21 Jul 2027, in 9 monthsRead from the law library 19 September 2026
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident (Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6)) 24 hoursReport a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected. 24 hoursFailing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority. Status since 29 Dec 2020Read from the law library 18 September 2026
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification) (Information and Communications Act, 2009 (No. 2 of 2009), sec. 140(3)-(6)) promptlyWhere an event affecting or jeopardizing the security of your services occurs and reveals a previously unknown risk, promptly and free of charge inform the affected subscriber of the risk, the measures they may take, and the estimated cost involved. Status since 29 May 2009Read from the law library 19 September 2026
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat (Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40) 24 hoursImmediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption. Status since 30 May 2018Read from the law library 14 September 2026
Kenya	Virtual Asset Service Providers Act, Notice of a Cyber-Security Incident (Virtual Asset Service Providers Act (No. 20 of 2025), s. 25) 7 business daysWithin seven working days of providing that notification, furnish the relevant regulatory authority with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 25(2)). Status since 4 Nov 2025Read from the law library 18 October 2026
Kenya	Virtual Asset Service Providers Regulations, Reporting of Cybersecurity Incidents (Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 26 and 99) 24 hoursNotify the relevant regulatory authority within twenty-four hours of discovering a cybersecurity incident that results from a cybersecurity event, which is any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information stored on them (regulation 99(1)). 5 business daysProvide a detailed report within five working days on whether the incident affects the services or network and information systems that support your critical or important functions, affects services you are authorised to provide, or is a malicious and unauthorized access to your network and information systems, including the remedial actions to mitigate it and prevent future events (regulation 99(2) and (3)). 24 hoursReport any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours (regulation 99(4)). Status since 22 Jul 2026Read from the law library 18 October 2026
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties (Loi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 27, 30 et 33, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe) without delayWhen you detect an event that could affect the security of a client's information systems, inform the national cybersecurity authority of it without delay. Status since 9 Aug 2021Read from the law library 17 September 2026
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure (Lei n.º 13/2026, arts. 57 a 66) promptlyIf you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content. Status since 29 Sep 2026Read from the law library 18 September 2026
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, Reporting of Cyber Threats to the National CERT (Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024) immediatelyImmediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network. 72 hoursReport the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund. Status in forceRead from the law library 17 September 2026
Seychelles	Seychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Reporting of Cyber Security Risk (Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, reg. 7) 24 hoursNotify the Authority within 24 hours of any attempt, where you discover a cyber security risk as a result of a cyber security event, meaning any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information on them (reg. 7(1)). 5 business daysFor a successful attempt, provide the Authority a report within 5 working days on whether the event affects or has affected the services or network and information systems that support your critical or important functions, the services you are authorized to provide, and whether it is or was malicious and unauthorized access to your network and information systems (reg. 7(2)). Status in forceRead from the law library 18 October 2026
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents (Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats)) immediatelyImmediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network. 7 daysReport the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported. Status since 15 Nov 2021Read from the law library 19 September 2026
Tunisia	Cybersecurity Incident Reporting and Emergency Response (Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25) immediatelyImmediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders. Status since 11 Sep 2023Read from the law library 18 September 2026

The Middle East Show the 1 provisionHide the 1 provision

Jurisdiction

Instrument, and the obligation lines that carry a clock

Jordan

Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty (Cyber Security Law No. (16) of 2019, Article 8(b)) 1 hour4 hours1 dayWhere the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets a reporting clock as short as 30 minutes for a Critical-tier incident, rising through roughly 1 hour for High, 4 hours for Medium, and 1 day for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low. Status since 16 Sep 2019Read from the law library 16 September 2026

Elsewhere Show the 13 provisionsHide the 13 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Andorra	Llei 22/2022, Incident Handling and Notification Obligation (Llei 22/2022, del 9 de juny, arts. 14 i 15) 72 hours72 hoursNotify the CSIRT-AD, without delay and in any event within 72 hours of detecting it, of any incident that has or may have significant effects on your essential or important service, including information on any cross-border effects; where you cannot yet establish that effect, you may omit it if you send a justificatory report within 72 hours of the notification explaining why. 24 hoursSubmit to the CSIRT-AD an initial notification of the incident without undue delay and in any event within 24 hours of becoming aware of it, stating where applicable whether the incident is presumed to result from an unlawful or malicious act (Article 15(4)(a)). 1 monthSend the CSIRT-AD a final report no later than one month after the initial notification, with a detailed description of the incident, its severity and impact, the type of threat or root cause likely to have triggered it, and the mitigation measures applied and ongoing (Article 15(4)(c)). without undue delayWhere appropriate, notify the recipients of your service, without undue delay, that a significant incident is likely to affect them and what measures or remedies they can take in response. without delayNotify the competent authority, through the CSIRT-AD and without delay, of a significant cyber threat to your essential or important service that you believe could result in a significant incident, once the threshold for that duty is further specified by regulation. Status since 23 Jun 2022Read from the law library 18 September 2026
Bermuda	Bermuda Digital Asset Business Act 2018: Senior Representative's Notice and Report of a Cyber Reporting Event (Digital Asset Business Act 2018, s. 20) forthwithHave your senior representative notify the Bermuda Monetary Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that a cyber reporting event involving your undertaking has occurred (s. 20(1) and (3)). 14 daysHave your senior representative furnish the Authority, within 14 days of that notification, with a written report setting out all the particulars of the case that are available to him (s. 20(2)). Status since 10 Sep 2018Read from the law library 18 October 2026
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock (§ 412, Subchapter III, C.B. No. 24-14 (Cybersecurity Act 2025), proposed new Chapter 4, Title 21, FSM Code) 24 hours72 hours30 daysNotify the Secretary of Justice and the CERT-FSM of a significant cybersecurity incident affecting your critical information infrastructure or an interconnected system: an early warning within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within 30 days of that notification. 30 days30 daysFor an ongoing significant cybersecurity incident, submit a progress report to the Secretary of Justice and the CERT-FSM within 30 days of the notification, and a final report within 30 days of the handling of the incident (Section 412(2)(d)). Status proposedRead from the law library 19 September 2026
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team (Log nr. 78/2019, Art. 8) as soon as may beNotify Iceland's national cybersecurity incident-response team as soon as may be about a serious incident or risk threatening the security of a network or information system; the Act sets no fixed hour-based clock of its own for this notification. Status since 1 Sep 2020Read from the law library 15 September 2026
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident (Cybersecurity Act 2026 (Act No. 7 of 2026), s. 21 (Part VI)) 24 hoursWhen you are the subject of a cybersecurity incident or threat of one, gather information about it, assess the risk to your critical infrastructure, customers, suppliers and other stakeholders, take appropriate preventative, mitigating and remedial measures to limit that risk, and report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after you detect it, in the form or manner the CERT prescribes. Status from a date not yet setRead from the law library 19 September 2026
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification (Cyber-Sicherheitsgesetz (CSG) vom 5. Dezember 2024, LGBl. 2025 Nr. 111, Art. 6) 24 hoursNotify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating, where relevant, whether the incident is suspected to result from unlawful or malicious acts or to have cross-border effect. 72 hoursFollow with a full notification within 72 hours of becoming aware, updating the early warning where relevant and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 month72 hoursSubmit an intermediate report on the Stabsstelle Cyber-Sicherheit's request, and a final report within one month of the 72-hour notification, describing the incident's severity and impact in detail, the likely threat or root cause, and the mitigation measures taken. 1 monthIf the incident is still ongoing when the final report falls due, submit a progress report at that point and a final report within one month of the incident being dealt with (Article 6(2)(e)). Status since 1 Feb 2025Read from the law library 15 September 2026
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting (Law on Information Security, Arts. 28 to 37) 24 hoursWhere a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30). 72 hours30 daysFor an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33). Status since 5 Dec 2024Read from the law library 18 September 2026
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations (Cybersecurity Act 2025, 40 MIRC Ch. 4 § 407 (P.L. 2025-0027)) immediatelyImmediately notify the Director and the CSIRT-MH (the Cyber Security Incident Response Team of the Marshall Islands) of a significant cybersecurity incident affecting your critical information infrastructure, of a significant incident on any interconnected computer system under your control, or of any other incident type the Director specifies by written order. 24 hours72 hours30 days30 days30 daysSubmit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a thirty-day progress report followed by a final report within thirty days of the incident's resolution. Status since 21 Apr 2025Read from the law library 19 September 2026
Serbia	Law on Information Security, Incident Reporting Obligations (Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 13-14, 24-25) 24 hoursNotify the single incident-reporting system, through the Ministry's or the Office for Information Security's website, of an incident that may significantly disrupt information security, without delay and at the latest within 24 hours of becoming aware of it. without delayNotify the users of your service, without delay, of an incident that causes or may cause a harmful effect on providing or using your service, together with any measures they can take to reduce or remove the harmful effect. 15 daysSubmit a final report within 15 days after the incident ends, covering its type, cause, duration, scope of impact, any cross-border effect, and the steps you took to remedy it. Status since 1 Jan 2026Read from the law library 18 September 2026
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident (Act 14 of 2025, s. 15) 24 hoursWithin 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification. Status from a date not yet setRead from the law library 19 September 2026
Turkey	Cybersecurity Law, Reporting and Cooperation Duties (Law No. 7545 (12 March 2025), Art. 7) without delayReport a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock. Status since 19 Mar 2025Read from the law library 14 September 2026
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty (Закон України "Про основні засади забезпечення кібербезпеки України" № 2163-VIII від 05.10.2017 (редакція від 03.04.2025, підстава - 4070-IX), ст. 6(4)-(5), ст. 9(2)) immediatelyInform CERT-UA immediately (невідкладно, without delay; the statute states no fixed hour clock) of a cybersecurity incident affecting your critical infrastructure object's communication or technological systems. Status since 9 May 2018Read from the law library 19 September 2026
Kosovo	Law No. 08/L-173 on Cyber Security, Incident Reporting and Enforcement (Law No. 08/L-173 on Cyber Security, Arts. 6, 8 and 24) 24 hoursAs an operator of essential services, notify the Agency for Cyber Security immediately, and no later than 24 hours after becoming aware, of a cyber incident with a significant impact on system security or service continuity, and notify affected persons or the public within a reasonable time where individual notice is impractical. immediatelyAs a digital service provider, notify the Agency for Cyber Security immediately upon becoming aware of a cyber incident with a significant impact on the digital service you provide. Status since 14 Mar 2023Read from the law library 18 September 2026

3Privacy law: personal-data breach notification, by jurisdiction

181 instruments in 169 jurisdictions in the law library's privacy topic under its breach-notification family state a reporting deadline, as of 21 October 2026: 126 a numeric clock, and 55 a standard such as "immediately" or "without undue delay" with no number. These bind the party that decides why and how personal data is processed, which for an agent is nearly always its OPERATOR, and the clock runs to the supervisory authority and, separately, to the people affected. The GDPR row is stated once for the EU and once for each member state, because each state's authority is the recipient.

10 more instruments in this family state no deadline in their obligation lines and are not listed here; the privacy law section has them.

European Union Show the 3 provisionsHide the 3 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
European Union	Commission Regulation on Personal Data Breach Notification by Electronic Communications Providers (Regulation (EU) No 611/2013) (Regulation (EU) No 611/2013) 24 hoursIf you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)). 24 hours3 daysWhere all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)). 3 daysIf you cannot provide all the information within the three-day period, notify as much as you have within it, submit to the competent national authority a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible (Article 2(3)). without undue delayNotify the subscriber or individual without undue delay after detection of the breach, whether or not you have yet notified the competent national authority (Article 3(3)). as soon as possibleIf you have a direct contractual relationship with the end user and, despite reasonable efforts, cannot identify within the timeframe all the individuals likely to be adversely affected, you may notify them through advertisements in major national or regional media in the relevant Member States within that timeframe, containing the Annex II information where necessary in a condensed form, and you must continue all reasonable efforts to identify and notify them as soon as possible (Article 3(7)). immediatelyIf you are contracted to deliver part of the electronic communications service without a direct contractual relationship with subscribers, immediately inform the contracting provider in the case of a personal data breach (Article 5). Status since 25 Aug 2013Read from the law library 10 October 2026
European Union	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 23 August 2026
European Union	ePrivacy Directive, Article 4(3) to (5), Personal Data Breach Notification (Directive 2002/58/EC, Art. 4(3)-(5)) without undue delayIf you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)). without undue delayWhere the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)). Status since 25 May 2011Read from the law library 10 October 2026

EU member states (the national layer) Show the 33 provisionsHide the 33 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Austria	GDPR Articles 33-34, Breach Notification in Austria (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Datenschutzbehorde without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Austria, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Belgium	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the GBA/APD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Belgium, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Bulgaria	Electronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications Services (Zakon za elektronnite saobshtenia (Закон за електронните съобщения), чл. 261в-261д) 3 daysIf you provide public electronic communications services, notify the KZLD within three days of establishing a personal data breach (Electronic Communications Act Article 261в, paragraph 1). promptlyPromptly notify the affected user or other person where the breach may adversely affect their personal data or privacy, unless you have shown the KZLD that appropriate technological protection measures were applied to the data concerned (Article 261в, paragraphs 2 and 3). Status since 29 Dec 2011Read from the law library 12 October 2026
Bulgaria	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Bulgaria, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Cyprus	GDPR Articles 33-34 and Law 125(I)/2018 Article 12, Breach Notification in Cyprus (Regulation (EU) 2016/679, Arts. 33-34; Law 125(I)/2018, Art. 12) 72 hoursNotify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, unless Law 125(I)/2018 Article 12 exempts you after an impact assessment and prior consultation with the Commissioner. Status since 25 May 2018Read from the law library 24 August 2026
Czech Republic	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify UOOU without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Czech Republic, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Germany	GDPR Articles 33-34, Breach Notification in Germany (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the competent data protection authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Germany, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Denmark	GDPR Articles 33-34, Breach Notification in Denmark (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Estonia	GDPR Articles 33-34, Breach Notification in Estonia (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Estonian Data Protection Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Estonia, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Spain	GDPR Articles 33-34 and LOPDGDD Articles 73(r)-(s) and 74(m)-(n), Breach Notification (Regulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n)) 72 hoursNotify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Spain, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 7 Dec 2018Read from the law library 24 August 2026
Finland	GDPR Articles 33-34, Breach Notification in Finland (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Data Protection Ombudsman without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Finland, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
France	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the CNIL without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in France, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Greece	GDPR Articles 33-34, Breach Notification in Greece (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Hellenic Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Greece, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Croatia	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify AZOP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Croatia, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Hungary	Act C of 2003 on Electronic Communications, Section 156, Personal Data Breach Notification by Electronic Communications Providers (2003. évi C. törvény (Eht.) 156. § (2)-(5)) without delayIf you provide a publicly available electronic communications service in Hungary, notify the National Media and Infocommunications Authority without delay when you detect a breach of subscriber personal data, meaning accidental or unlawful handling or processing of the personal data you transmit, store or otherwise handle in providing the service (Eht. section 156, paragraphs 2 and 3). without undue delayWhere a breach is likely to harm a subscriber's or another individual's personal data or privacy, also notify that person without undue delay, unless you satisfactorily show the Authority that you applied appropriate technical protection measures to the data affected (Eht. section 156, paragraph 5). Status since 3 Aug 2011Read from the law library 12 October 2026
Hungary	GDPR Articles 33-34 and Infotörvény Sections 25/J-25/K, Breach Notification in Hungary (Regulation (EU) 2016/679, Arts. 33-34; 2011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section) 72 hoursNotify NAIH without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Hungary, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. 72 hoursIf you process personal data in Hungary for law-enforcement, national-security or defence purposes, record the breach data Section 25/J(5) lists and report the breach to NAIH without delay, no later than 72 hours after you become aware of it, under Information Act (Infotv.) Section 25/J(1). Status since 25 May 2018Read from the law library 24 August 2026
Ireland	GDPR Articles 33-34, Breach Notification in Ireland (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Italy	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Italy, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Lithuania	GDPR Articles 33-34, Breach Notification in Lithuania (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify VDAI without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Lithuania, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Lithuania	Law on Electronic Communications Article 74, Personal Data Breach Notification by Electronic Communications Providers (Lietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135, Art. 74(4)-(8)) without delayIf you provide public electronic communications networks or services, notify the State Data Protection Inspectorate without delay of a personal data security breach (Law on Electronic Communications Article 74, paragraph 4). without delayNotify the subscriber, registered user or other person without delay where the breach may adversely affect the security of their data or their privacy, unless you prove to the Inspectorate that appropriate technical measures made the data inaccessible to unauthorized persons (Article 74, paragraphs 4 and 5). Status since 1 Aug 2011Read from the law library 12 October 2026
Luxembourg	GDPR Articles 33-34, Breach Notification in Luxembourg (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Luxembourg, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Latvia	GDPR Articles 33-34, Breach Notification in Latvia (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Data State Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Latvia, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Malta	GDPR Articles 33-34, Breach Notification in Malta (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the IDPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Malta, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Netherlands	GDPR Articles 33-34 and UAVG Article 42, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42) 72 hoursNotify the AP without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Netherlands, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, subject to UAVG Article 42's national exception. Status since 25 May 2018Read from the law library 12 October 2026
Netherlands	Telecommunicatiewet Article 11.3a, Personal Data Breach Notification by Electronic Communications Providers (Telecommunicatiewet, Art. 11.3a) without delayIf you provide a public electronic communications service, notify the Autoriteit persoonsgegevens without delay of a security breach that adversely affects personal data processed in connection with the service in the European Union (Telecommunicatiewet Article 11.3a, paragraph 1). without delayNotify the person whose personal data is concerned without delay where the breach is likely to have adverse effects on their privacy, unless the Autoriteit persoonsgegevens finds that appropriate technical protection measures made the data unintelligible to anyone without a right of access (Article 11.3a, paragraphs 2 and 5). Status since 5 Jun 2012Read from the law library 12 October 2026
Poland	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify UODO without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Poland, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Portugal	GDPR Articles 33-34, Breach Notification in Portugal (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 25 May 2018Read from the law library 24 August 2026
Romania	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Romania, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 12 October 2026
Romania	Law 506/2004 Article 3, Personal Data Breach Notification by Electronic Communications Providers (Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice, Art. 3(5)-(12)) without delayIf you provide publicly available electronic communications services, notify the ANSPDCP without delay of a personal data security breach (Law 506/2004 Article 3, paragraph 6). without delayNotify the subscriber or other person without delay where the breach could affect their personal data or private life, unless you have shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned (Article 3, paragraphs 7 and 8). Status since 26 Apr 2012Read from the law library 12 October 2026
Sweden	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34; Dataskyddslagen (2018:218), ch. 1 § 4) 72 hoursNotify IMY without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Sweden, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, unless the incident is one that must be reported under the Protective Security Act (2018:585) or notified under the Act (2019:109) on protective security in the Riksdag and its authorities, which Dataskyddslagen chapter 1 section 4 takes outside Articles 33 and 34. Status since 25 May 2018Read from the law library 12 October 2026
Slovenia	Electronic Communications Act (ZEKom-2) Article 227, Personal Data Breach Notification by Providers of Public Communications Services (Zakon o elektronskih komunikacijah (ZEKom-2), Uradni list RS, št. 130/2022, 227. člen) without delayIf you provide public communications services, notify the Agency for Communication Networks and Services (AKOS) without delay of a personal data security breach (ZEKom-2 Article 227, paragraph 1). without undue delayNotify the affected subscriber or individual without undue delay where the breach is likely to harm their personal data and privacy, unless you have satisfactorily shown the agency that appropriate technical protection measures were applied to the data concerned (Article 227, paragraphs 2 and 3). Status since 10 Nov 2022Read from the law library 12 October 2026
Slovenia	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Slovenian Information Commissioner without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Slovenia, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026
Slovakia	GDPR Articles 33-34, Breach Notification (Regulation (EU) 2016/679, Arts. 33-34) 72 hoursNotify the Slovak Office for Personal Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Slovakia, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. Status since 25 May 2018Read from the law library 24 August 2026

United Kingdom Show the 1 provisionHide the 1 provision

Jurisdiction

Instrument, and the obligation lines that carry a clock

United Kingdom

UK GDPR Articles 33-34 and PECR, Breach Notification in the United Kingdom (UK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025) 72 hoursNotify the Information Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in the United Kingdom, unless the breach is unlikely to risk their rights and freedoms. 72 hoursNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, and if you are a telecoms or ISP-type provider, notify a PECR breach to the Information Commission within 72 hours. Status since 25 May 2018Read from the law library 24 August 2026

United States, federal Show the 2 provisionsHide the 2 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
United States	GLBA Safeguards Rule Breach Notification Amendment (16 CFR Section 314.4(j)) 30 daysNotify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers. Status since 13 May 2024Read from the law library 23 August 2026
United States	HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D (Sections 164.400-164.414)) 60 daysNotify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. 60 daysNotify the Secretary of Health and Human Services, for breaches of unsecured protected health information involving fewer than 500 individuals that were discovered during a calendar year, not later than 60 days after the end of that calendar year. 60 daysFor a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. 60 daysIf you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. Status since 23 Sep 2009Read from the law library 23 August 2026

United States, states Show the 53 provisionsHide the 53 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Alaska	Alaska Personal Information Protection Act, breach notification duty (Alaska Stat. Secs. 45.48.010-45.48.070) without unreasonable delayDisclose a breach of the security of an information system containing an Alaska resident's personal information to each affected resident in the most expeditious time possible and without unreasonable delay. Status since 1 Jul 2009Read from the law library 27 August 2026
Alabama	Alabama Data Breach Notification Act of 2018 (Ala. Code sec. 8-38-1 et seq. (Act 2018-396)) 45 daysNotify each affected Alabama resident within 45 days after receiving notice of a breach from a third-party agent or after determining that a breach of security has acquired sensitive personally identifying information and is reasonably likely to cause substantial harm. 45 daysGive the Alabama Attorney General written notice within 45 days when more than 1,000 individuals must be notified of a breach. 10 daysAs a third-party agent that has experienced a breach of security in a system it maintains, notify the covered entity as expeditiously as possible and without unreasonable delay, and no later than 10 days after determining the breach occurred or having reason to believe it occurred. without unreasonable delayNotify the nationwide consumer reporting agencies without unreasonable delay when more than 1,000 individuals must be notified at a single time. Status in forceRead from the law library 27 August 2026
Arkansas	Arkansas Personal Information Protection Act, breach notification and security (Ark. Code Ann. secs. 4-110-101 to 4-110-108) without unreasonable delayNotify each affected Arkansas resident of a breach of security without unreasonable delay. 45 daysNotify the Arkansas Attorney General if the breach affects more than 1,000 individuals, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever occurs first. Status in forceRead from the law library 27 August 2026
Arizona	Arizona data breach notification law (A.R.S. secs. 18-551 to 18-552) 45 daysNotify each affected Arizona resident of a breach of system security involving their personal information within 45 days after determining the breach occurred. 45 daysNotify the Arizona Attorney General and the director of the Arizona Department of Homeland Security, in writing, within 45 days after determining the breach occurred, and the three largest nationwide consumer reporting agencies, if the breach requires notification of more than 1,000 individuals (A.R.S. 18-552(B)). 45 daysWhere a law enforcement agency has delayed the notifications, make them within 45 days after the agency tells you that they no longer compromise its investigation (A.R.S. 18-552(D)). Status in forceRead from the law library 27 August 2026
California	California Data Breach Notification Law, as amended by SB 446 (Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)) 30 daysNotify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification. 15 daysNotify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents. Status since 1 Jan 2026Read from the law library 23 August 2026
Colorado	C.R.S. 6-1-716, Notification of Security Breach (C.R.S. section 6-1-716) 30 daysIf you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred. 30 daysNotify the Colorado Attorney General of a security breach affecting 500 or more Colorado residents without unreasonable delay and not later than 30 days after the date of determination that a security breach occurred; also notify nationwide consumer reporting agencies if more than 1,000 residents are affected. Status since 1 Sep 2018Read from the law library 23 August 2026
Connecticut	Breach of security re computerized data containing personal information (Conn. Gen. Stat. § 36a-701b) 60 daysNotify each affected Connecticut resident of a breach of security involving personal information without unreasonable delay and no later than 60 days after discovery, unless federal law requires a shorter time. Status in forceRead from the law library 2 September 2026
District of Columbia	Consumer Security Breach Notification (D.C. Code §§ 28-3851 to 28-3853 (Title 28, Chapter 38, Subchapter II)) without unreasonable delayIf your business conducts business in the District of Columbia and discovers a breach of the security of a system containing a District resident's personal information, notify each affected resident in the most expedient time possible and without unreasonable delay. Status since 1 Jul 2007Read from the law library 6 September 2026
Delaware	Computer Security Breaches (Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104) 60 daysNotify affected Delaware residents of a breach of security without unreasonable delay and no later than 60 days after determining the breach occurred. 60 days60 daysIf reasonable diligence did not let you identify within 60 days that certain residents' personal information was in the breach, notify those residents as soon as practicable after determining that it was, and notify the Delaware Attorney General of the breach within 60 days after determining the breach occurred, unless you have provided substitute notice within that period (section 12B-102(c)(3)). Status in forceRead from the law library 15 October 2026
Florida	Florida Information Protection Act, breach notification (Fla. Stat. § 501.171) 30 daysNotify the Florida Department of Legal Affairs of a breach of security affecting 500 or more individuals in Florida as expeditiously as practicable, and no later than 30 days after determining a breach occurred or having reason to believe one occurred. 30 days15 daysNotify each affected Florida individual of a breach no later than 30 days after determining a breach occurred, unless you obtain a written 15-day extension for good cause. 30 daysIf you need 15 additional days to notify affected individuals, give the Florida Department of Legal Affairs written notice of good cause for the delay within 30 days after determining a breach occurred or having reason to believe one occurred. 30 daysIf you determine that a breach is not likely to result in identity theft or other financial harm and so do not notify individuals, submit that written determination to the Florida Department of Legal Affairs within 30 days after the determination. 10 daysIf you are a third-party agent that maintains a system that suffers a breach of security, notify the covered entity as expeditiously as practicable and no later than 10 days after determining a breach occurred or having reason to believe one occurred. Status since 1 Jul 2014Read from the law library 27 August 2026
Georgia	Georgia Personal Identity Protection Act, notification of security breach (O.C.G.A. Sec. 10-1-912) without unreasonable delayGive notice of a breach of the security of a system containing a Georgia resident's personal information in the most expedient time possible and without unreasonable delay. 24 hoursNotify the information broker or data collector you maintain data for of any breach you discover within 24 hours following discovery, so that party can meet its own notice duty. Status in forceRead from the law library 27 August 2026
Guam	Notification of Breaches of Personal Information (9 GCA §§ 48.10-48.80) without unreasonable delayDisclose a breach of the security of your system to any affected Guam resident without unreasonable delay once you know or reasonably believe the breach caused or will cause identity theft or other fraud. as soon as practicableIf you hold a Guam resident's computerized personal information for another owner or licensee rather than for yourself, notify that owner or licensee as soon as practicable after discovering a breach. Status in forceRead from the law library 5 September 2026
Hawaii	Hawaii Security Breach of Personal Information Act, notice of security breach (Haw. Rev. Stat. Secs. 487N-1, 487N-2) without unreasonable delayProvide clear and conspicuous notice, without unreasonable delay, to a Hawaii resident affected by a security breach of a system containing their personal information, describing the incident, the type of information exposed, and remedial steps taken. Status since 1 Jan 2007Read from the law library 27 August 2026
Iowa	Personal Information Security Breach Protection (Iowa Code § 715C.2) without unreasonable delayNotify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay. 5 business daysNotify the Iowa Attorney General's consumer protection division within five business days of notifying consumers, if the breach requires notifying more than 500 Iowa residents. Status in forceRead from the law library 27 August 2026
Idaho	Identity Theft Act, breach of security disclosure duty (Idaho Code § 28-51-105) as soon as possibleGive notice to each affected Idaho resident as soon as possible, and in the most expedient time possible without unreasonable delay, after discovering a breach of system security involving personal information. 24 hoursIf you are a government agency, also notify the Idaho Attorney General within 24 hours of discovering the breach; this duty does not extend to a private commercial entity. Status in forceRead from the law library 28 August 2026
Illinois	Personal Information Protection Act, data breach notification (815 ILCS 530/1 et seq. (P.A. 94-36, eff. 1 January 2006)) without unreasonable delayNotify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual. without unreasonable delayNotify the Illinois Attorney General once a single breach requires you to notify more than 500 Illinois residents, in the most expedient time possible and without unreasonable delay, and in no event later than when you notify those residents. 5 business daysIf you are a HIPAA covered entity or business associate that notifies the federal Secretary of Health and Human Services of a breach, notify the Illinois Attorney General within 5 business days of notifying the Secretary. 45 daysIf you are a State agency, notify the Illinois Attorney General within 45 days of discovering a single breach affecting more than 250 Illinois residents, or when you first notify residents if that is sooner, unless you have good cause for reasonable delay. 72 hoursIf you are a State agency directly responsible to the Governor, notify the Chief Information Security Officer of the Department of Innovation and Technology and the Attorney General without delay, and no later than 72 hours after discovering a breach affecting more than 250 Illinois residents or an instance of aggravated computer tampering. 5 business daysIf you are a State agency that has had a breach, report it to the General Assembly within 5 business days of discovering or being notified of the breach, listing the breaches and the corrective measures taken. 5 daysIf you are a State agency and you determine who perpetrated a breach, report that to the General Assembly within 5 days after the determination, unless the report would jeopardize the security of Illinois residents or compromise a security investigation. Status since 1 Jan 2006Read from the law library 23 August 2026
Indiana	Disclosure of Security Breach Act (Ind. Code §§ 24-4.9-3-1, 24-4.9-3-3, 24-4.9-4-1, 24-4.9-4-2) 45 daysDisclose a breach to affected Indiana residents without unreasonable delay and no later than 45 days after discovering that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud. 45 daysMake every disclosure or notification the statute requires, including notice to the Indiana Attorney General, notice to each nationwide consumer reporting agency, and a data holder's notice to the data base owner, without unreasonable delay and no later than 45 days after discovering the breach. Status in forceRead from the law library 27 August 2026
Kansas	Kansas Breach Notification Act, notice of security breach (K.S.A. 50-7a02(a)-(f)) as soon as possibleGive notice to each affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay, if the investigation shows misuse occurred or is reasonably likely. There is no fixed numeric deadline in the statute; do not rely on a 45-day figure some secondary sources describe. Status since 1 Jul 2006Read from the law library 28 August 2026
Kansas	Student Data Privacy Act, breach notice for student data (K.S.A. 72-6318) immediatelyImmediately notify the affected Kansas student, or the student's parent or guardian, of a breach or unauthorized disclosure of student data if your entity has access to that data. Status since 1 Jul 2014Read from the law library 28 August 2026
Kentucky	Notification to affected persons of computer security breach (KRS 365.732) without unreasonable delayNotify an affected Kentucky resident of a breach involving unencrypted personal information in the most expedient time possible and without unreasonable delay. Status since 15 Jul 2014Read from the law library 27 August 2026
Louisiana	Database Security Breach Notification Law, notice duty (La. R.S. 51:3074(C), (E), (I)) 60 daysNotify each affected Louisiana resident of a breach involving personal information in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery. 60 daysIf you delay notice, notify the Attorney General in writing of the reasons for the delay within the 60 days after discovery of the breach (R.S. 51:3074(E)). 60 daysIf you maintain computerized personal information you do not own, notify the owner or licensee of a breach in the most expedient time possible and without unreasonable delay, and no later than 60 days after discovering it (R.S. 51:3074(D), (E)). Status in forceRead from the law library 28 August 2026
Massachusetts	Security Breach statute, duty to report breach of personal information (Mass. Gen. Laws ch. 93H, § 3) as soon as practicableNotify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information. Status since 31 Oct 2007Read from the law library 28 August 2026
Maryland	Maryland Personal Information Protection Act (MPIPA), breach notification (Md. Code Ann., Com. Law §§ 14-3501, 14-3504 (Title 14, Subtitle 35)) 45 daysNotify each affected Maryland individual as soon as reasonably practicable, and no later than 45 days after discovering or being notified of the breach, once you determine a likelihood that personal information has been or will be misused. 10 daysIf you maintain computerized data that you do not own or license, notify the owner or licensee of a breach as soon as reasonably practicable, and no later than 10 days after you discover or are notified of the breach (Com. Law 14-3504(c)). 7 daysWhere a law enforcement agency delays that notice to the owner or licensee, notify them as soon as reasonably practicable, and no later than 7 days after the agency determines that notification will not impede a criminal investigation or jeopardize homeland or national security (Com. Law 14-3504(d)). 7 days45 daysWhere notification is delayed because a law enforcement agency says it would impede an investigation, notify within 7 days after that delay is cleared, or by the original 45-day deadline, whichever is later. Status in forceRead from the law library 2 September 2026
Maine	Notice of Risk to Personal Data (10 M.R.S. secs. 1347-1349) 30 daysNotify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope, absent a law enforcement delay. 7 business daysWhere a law enforcement investigation delays notice, notify affected Maine residents no later than 7 business days after a law enforcement agency determines that notification will not compromise a criminal investigation (10 M.R.S. 1348(3)). Status in forceRead from the law library 27 August 2026
Michigan	Identity Theft Protection Act, breach of security notice duty (MCL 445.72) without unreasonable delayGive breach notice without unreasonable delay unless you determine the breach has not caused and is not likely to cause substantial loss, injury, or identity theft to affected Michigan residents. Status since 2 Jul 2007Read from the law library 28 August 2026
Minnesota	Minnesota breach notification (Minn. Stat. § 325E.61) without unreasonable delayDisclose a breach of the security of the system to an affected Minnesota resident in the most expedient time possible and without unreasonable delay. Minnesota sets no fixed numeric-day cap on notice to residents, unlike several peer states. 48 hoursIf you notify more than 500 Minnesota residents of one breach at one time, also notify, within 48 hours, every nationwide consumer reporting agency of the timing, distribution, and content of the notices (Minn. Stat. 325E.61, subd. 2). immediatelyNotify the data owner immediately upon discovering a breach if you maintain, but do not own, the affected data. Status since 1 Jan 2006Read from the law library 27 August 2026
Missouri	Notice of security breach of personal information (Mo. Rev. Stat. Sec. 407.1500) without unreasonable delayNotify each affected Missouri consumer of a breach of security involving their personal information without unreasonable delay. without unreasonable delayNotify the Missouri Attorney General's office and every nationwide consumer reporting agency without unreasonable delay if you provide notice to more than 1,000 consumers at one time. Status since 28 Aug 2009Read from the law library 27 August 2026
Mississippi	Breach notification law, notice of security breach (Miss. Code Ann. § 75-24-29(2)-(3)) without unreasonable delayDisclose a breach of security to all affected Mississippi individuals without unreasonable delay, unless your investigation reasonably determines the breach will not likely result in harm. Status since 1 Jul 2011Read from the law library 28 August 2026
Montana	Notification of security breach (Mont. Code Ann. § 30-14-1704) without unreasonable delayNotify affected Montana residents of a breach of security without unreasonable delay, and simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office. Status in forceRead from the law library 27 August 2026
North Carolina	Identity Theft Protection Act, security breach notification (N.C. Gen. Stat. Secs. 75-61, 75-65) without unreasonable delayNotify each affected North Carolina resident of a security breach involving their personal information without unreasonable delay, consistent with the legitimate needs of law enforcement. Status in forceRead from the law library 2 September 2026
North Dakota	Notice of Security Breach for Personal Information (N.D. Cent. Code ch. 51-30) without unreasonable delayDisclose a breach of the security system to any affected North Dakota resident in the most expedient time possible and without unreasonable delay. Status in forceRead from the law library 28 August 2026
New Hampshire	Notice of Security Breach (RSA 359-C:19-21) as soon as possibleNotify affected New Hampshire residents and the Attorney General's office as soon as possible on determining a security breach of personal information occurred. Status since 1 Jan 2007Read from the law library 2 September 2026
New Jersey	New Jersey Identity Theft Prevention Act, breach notification (N.J. Stat. § 56:8-163) without unreasonable delayDisclose the breach to each affected New Jersey resident in the most expedient time possible and without unreasonable delay. New Jersey sets no fixed numeric-day cap. Status since 1 Jan 2006Read from the law library 27 August 2026
New Mexico	Data Breach Notification Act (Laws 2017, ch. 36, House Bill 15, Sections 1 to 12 (NMSA 1978, Secs. 57-12C-1 to 57-12C-12)) 45 daysNotify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery. 45 days45 daysNotify the New Mexico Attorney General's office and the major consumer reporting agencies that compile files nationwide of a security breach affecting more than 1,000 New Mexico residents in the most expedient time possible and no later than 45 calendar days, and tell the Attorney General how many residents were notified and send it a copy of the resident notice within 45 calendar days following discovery of the breach (Section 10). 45 daysIf you maintain or are licensed to possess data you do not own or license, notify the owner or licensee of a security breach in the most expedient time possible and no later than 45 calendar days following discovery of the breach (Section 6). Status since 16 Jun 2017Read from the law library 28 August 2026
Nevada	Security breach of personal information, notification (NRS 603A.220) without unreasonable delayDisclose a security breach of personal information to an affected Nevada resident in the most expedient time possible and without unreasonable delay. Nevada sets no fixed numeric deadline. Status since 1 Jan 2006Read from the law library 2 September 2026
New York	Stop Hacks and Improve Electronic Data Security (SHIELD) Act, breach notification duty (N.Y. Gen. Bus. Law § 899-aa) 30 daysDisclose a breach of the security of your system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach. 30 daysIf you maintain computerized data that includes private information you do not own, notify the owner or licensee of any breach of the security of the system immediately, and in any event within 30 days following discovery, if the information was or is reasonably believed to have been accessed or acquired without valid authorization (Section 899-aa(3)). 5 business daysIf you are a covered entity that must notify the Secretary of Health and Human Services of a breach under HIPAA or the HITECH Act, notify the New York Attorney General within 5 business days of notifying the Secretary (Section 899-aa(9)). 10 daysIf you decide not to notify affected persons because an exposure was an inadvertent disclosure by persons authorized to access private information that will not likely result in misuse or harm, and the incident affects over 500 New York residents, submit your written determination to the New York Attorney General within 10 days after the determination (Section 899-aa(2)(a)). Status since 23 Oct 2019Read from the law library 27 August 2026
Ohio	Security Breach Notification Act (Ohio Rev. Code Sec. 1349.19) 45 daysNotify an affected Ohio resident of a security breach involving their personal information in the most expedient time possible and no later than 45 days after discovery. without unreasonable delayNotify every nationwide consumer reporting agency without unreasonable delay if a single breach affects more than 1,000 Ohio residents. Status since 30 Mar 2007Read from the law library 29 August 2026
Oklahoma	Security Breach Notification Act (Okla. Stat. tit. 24, Secs. 162-166) without unreasonable delayProvide notice of a breach of security involving personal information without unreasonable delay. 60 daysNotify the Oklahoma Attorney General within 60 days of consumer notice if the breach affects 500 or more Oklahoma residents (1,000 or more for a breach maintained by a credit bureau). Status since 1 Jan 2026Read from the law library 28 August 2026
Oregon	Notice of breach of security (ORS 646A.604) 45 daysNotify each affected Oregon consumer of a breach of security, including one you learn of through a vendor, in the most expeditious manner possible and not later than 45 days after discovering or receiving notification of the breach, and notify the Oregon Attorney General as well once more than 250 Oregon consumers are notified (ORS 646A.604(1), (3)). 10 daysIf you are a vendor that discovers a breach of security or has reason to believe one has occurred, notify each covered entity you have a contract with as soon as is practicable and not later than 10 days after discovering the breach or having reason to believe it occurred, and if you contract with another vendor that serves a covered entity, notify that vendor the same way (ORS 646A.604(2)). Status in forceRead from the law library 27 August 2026
Pennsylvania	Breach of Personal Information Notification Act (73 P.S. secs. 2302, 2303, 2305, 2308 (Act 94 of 2005)) without unreasonable delayNotify each affected Pennsylvania resident of a breach of system security involving personal information without unreasonable delay. 7 business daysIf you are a State agency, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach, and notify the Office of Attorney General concurrently (Section 3(a.1)(1)). 3 business daysIf you are a State agency under the Governor's jurisdiction, also notify the Governor's Office of Administration of a breach of the security of the system within 3 business days following determination of the breach (Section 3(a.1)(3)). 7 business daysIf you are a county, public school or municipality, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach (Section 3(a.2)). 3 business daysIf you are a county, public school or municipality, also notify the district attorney of the county where the breach occurred within 3 business days following determination of the breach (Section 3(a.2)). Status since 20 Jun 2006Read from the law library 15 October 2026
Puerto Rico	Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification) (Ley Núm. 111 de 7 de septiembre de 2005, según enmendada; 10 L.P.R.A. §§ 4051-4055) as expeditiously as possibleNotify affected Puerto Rico residents of a security breach of an information bank containing their personal information as expeditiously as possible. 10 daysReport the breach to the Department of Consumer Affairs within ten non-extendable days of detecting it. Status in forceRead from the law library 5 September 2026
Rhode Island	Identity Theft Protection Act of 2015, notification of breach (R.I. Gen. Laws secs. 11-49.3-4, 11-49.3-5) 45 days30 daysNotify affected Rhode Island residents of a breach posing a significant risk of identity theft within 45 days of confirming the breach, or within 30 days if you are a state or municipal agency. Status in forceRead from the law library 27 August 2026
South Carolina	Business data breach of security, notification statute (S.C. Code Ann. sec. 39-1-90) without unreasonable delayNotify each affected South Carolina resident of a breach of security involving personal identifying information in the most expedient time possible and without unreasonable delay. Status since 1 Jul 2009Read from the law library 2 September 2026
South Dakota	Breach of system security, notification statute (SDCL secs. 22-40-19 to 22-40-26 (SL 2018 ch. 135)) 60 daysNotify each affected South Dakota resident of a breach of system security not later than 60 days after discovery, absent a law enforcement delay. Status since 1 Jul 2018Read from the law library 28 August 2026
Texas	Identity Theft Enforcement and Protection Act, breach notification (Tex. Bus. & Com. Code sec. 521.053, as amended by Tex. SB 768, 88th Legislature (2023)) 60 daysNotify each affected Texas resident of a breach of system security involving their sensitive personal information without unreasonable delay and no later than 60 days after determining the breach occurred. 30 daysNotify the Texas Attorney General as soon as practicable and no later than 30 days after determining the breach occurred, if the breach affects 250 or more Texas residents. Status since 1 Apr 2009Read from the law library 23 August 2026
Utah	Protection of Personal Information Act (Utah Code 13-44-101 et seq.) promptlyIf unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay. Status since 1 May 2024Read from the law library 23 August 2026
Virginia	Breach of personal information notification (Va. Code Ann. § 18.2-186.6) without unreasonable delayNotify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery. Status in forceRead from the law library 2 September 2026
U.S. Virgin Islands	Disclosure of Breach of Security (Identity Theft and Privacy Protection) (14 V.I.C. §§ 2208-2209) without unreasonable delayNotify an affected Virgin Islands resident without unreasonable delay after discovering that unencrypted personal information (a name combined with a Social Security number, driver's license number, or financial account number with its access code) was acquired without authorization. Status in forceRead from the law library 5 September 2026
Vermont	Security Breach Notice Act (9 V.S.A. sec. 2435) 45 daysNotify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery. 14 business daysNotify the Attorney General or the Department of Financial Regulation, as applicable, of the date of the breach and the date of discovery, with a preliminary description of the breach, within 14 business days of discovering the breach or of notifying consumers, whichever is sooner. Status since 1 Jan 2007Read from the law library 27 August 2026
Washington	Notice of security breaches involving personal information (RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368) 30 daysNotify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery. 30 daysNotify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered. Status since 1 Mar 2020Read from the law library 2 September 2026
Wisconsin	Notice of unauthorized acquisition of personal information (Wis. Stat. sec. 134.98) 45 daysMake reasonable efforts to notify each affected Wisconsin individual of an unauthorized acquisition of their personal information within a reasonable time, not to exceed 45 days after learning of it. Status since 31 Mar 2006Read from the law library 28 August 2026
West Virginia	Breach of Security of Consumer Information (W. Va. Code secs. 46A-2A-101 to 46A-2A-105) without unreasonable delayNotify each affected West Virginia resident of a breach of security involving personal information without unreasonable delay. Status in forceRead from the law library 28 August 2026
Wyoming	Breach of the security of a computerized data system, notification duty (Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511) as soon as possibleGive notice as soon as possible to each affected Wyoming resident once your investigation determines misuse of their personal identifying information has occurred or is reasonably likely. Status in forceRead from the law library 28 August 2026

Asia and the Pacific Show the 15 provisionsHide the 15 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Australia	Privacy Act 1988 (Cth), Notifiable Data Breaches Scheme (Privacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL) as soon as practicablePrepare a statement about an eligible data breach and give a copy to the Information Commissioner as soon as practicable after becoming aware of reasonable grounds to believe the breach happened. Status since 22 Feb 2018Read from the law library 6 September 2026
Brunei Darussalam	Personal Data Protection Order 2025, breach notification (Personal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29)) 3 daysBrunei's Personal Data Protection Order 2025 has required, since this duty (Part 7) took effect 1 January 2026 under Government Gazette No. S 11/2025, an organisation to notify the Authority within 3 days of assessing that a breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, and to notify each affected individual, for a breach involving any personal data including a voiceprint or faceprint. Status since 1 Jan 2026Read from the law library 29 August 2026
China	Personal Information Protection Law, Data Breach Notification (PIPL Art. 57) immediatelyUpon discovering an actual or possible leak, alteration, or loss of personal information, immediately take remedial measures and notify both the competent personal information protection department and every affected individual, unless the remedial measures can be shown to effectively prevent harm. Status since 1 Nov 2021Read from the law library 23 August 2026
Indonesia	Law on Personal Data Protection, breach notification (Law No. 27 of 2022 on Personal Data Protection, Article 46) 72 hoursAn app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 72 hours to the affected individual and to the supervisory institution, describing the data disclosed and the remedial measures taken. Status since 17 Oct 2022Read from the law library 29 August 2026
India	Digital Personal Data Protection Act, 2023, breach notification duties (Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6)) 72 hoursAn app must notify the Data Protection Board and each affected data principal of a personal data breach, including one covering a biometric identifier, without delay, and must supply the Board a detailed follow-up report within 72 hours of becoming aware of the breach. Status from 13 May 2027, in 7 monthsRead from the law library 29 August 2026
Cambodia	Cambodia's Draft Law on Personal Data Protection, personal data breach notification (Draft Law on Personal Data Protection, articles 21-22 (personal data breach notification)) 72 hoursA data controller must notify the Ministry of Post and Telecommunications immediately, but no later than 72 hours of becoming aware of a personal data breach that may pose a risk to the data subject or another natural person, or give the Ministry valid reasons for any delay. immediatelyA data controller must notify the affected data subject immediately upon becoming aware of a personal data breach that may pose a high risk to their rights and freedoms, unless the controller has already secured the data, has taken steps removing the high risk, or individual notice would be disproportionately burdensome, in which case a public notice serves instead. Status proposedRead from the law library 19 September 2026
South Korea	Personal Information Protection Act, breach notification duties (Act No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40) 72 hoursAn app that suffers a leak, theft, or unauthorized disclosure of Korean personal data must notify affected data subjects within 72 hours of becoming aware of it, or without delay once the cause ceases to exist where urgent containment measures are needed or an unavoidable cause such as a natural disaster prevents it (Enforcement Decree Article 39(1)). 72 hoursReport the breach to the PIPC or the Korea Internet and Security Agency within 72 hours of becoming aware of it if it affects 1,000 or more data subjects, involves sensitive information or personally identifiable information, or resulted from illegal external access, or without delay once the cause ceases to exist where an unavoidable cause prevents it (Enforcement Decree Article 40(1)). Status since 15 Sep 2023Read from the law library 15 October 2026
Kazakhstan	Law on Personal Data and Their Protection, breach notification (Law No. 94-V (21 May 2013), Art. 25(2)) 1 business dayAn app that suffers a personal data security breach involving Kazakhstani data subjects must notify the competent authority within one business day from the moment the breach is detected, naming the contact details of the person responsible for organizing personal data processing where one exists. The Law runs this notice to the competent authority, not to the affected individuals. Status since 1 Jul 2024Read from the law library 29 August 2026
Mongolia	Law on Protection of Personal Data, breach notification (Law on Protection of Personal Data (17 December 2021), Art. 22; Art. 25.1.3; Art. 10.5) immediatelyAn app that is a controller of Mongolian personal data must notify the data subject immediately when a violation found in collecting or processing the data is likely to harm the data subject's rights and legitimate interests, stating the violation, its likely adverse effects and the measures taken. An app that processes data for a controller must tell the controller as soon as it learns of such a violation. A controller must keep a record of the measures taken against the violation and deliver it to the National Human Rights Commission each January and whenever the Commission requires it. An app that suffers a security breach of, or cyberattack on, an information system used to collect, process or use the data must send a notification to the state digital-development and communications body; the Act sets no numeric deadline for that notification. Status since 1 May 2022Read from the law library 29 August 2026
Malaysia	Personal Data Protection Act, data protection officer and breach notification (Act 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force 1 June 2025) 72 hoursA data controller who reasonably believes a personal data breach has occurred must notify the Commissioner as soon as practicable, which the Commissioner's guideline puts at no later than 72 hours from the occurrence of the breach, and must notify affected data subjects without unnecessary delay where the breach causes or is likely to cause significant harm. Status since 1 Jun 2025Read from the law library 29 August 2026
New Zealand	Privacy Act 2020, Notifiable Privacy Breaches (Privacy Act 2020 (NZ), No 31, ss. 112-118) as soon as practicableNotify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused or be likely to cause serious harm, has occurred. as soon as practicableNotify each affected individual, or give public notice if individual notice is not reasonably practicable, as soon as practicable after becoming aware of a notifiable privacy breach, unless a statutory exception or permitted delay applies. Status since 1 Dec 2020Read from the law library 6 September 2026
Philippines	Data Privacy Act of 2012, breach notification (Republic Act No. 10173 (2012), Section 20(f)) promptlyAn app that reasonably believes sensitive personal information or identity-fraud-enabling information of an individual in the Philippines has been acquired by an unauthorized person, in a way likely to cause serious harm, must promptly notify the National Privacy Commission and the affected individuals. Status since 15 Aug 2012Read from the law library 29 August 2026
Singapore	Personal Data Protection Act, data breach notification (Personal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020) 3 daysAn app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies. Status since 1 Feb 2021Read from the law library 29 August 2026
Thailand	Personal Data Protection Act, breach notification (Personal Data Protection Act B.E. 2562 (2019), Section 37(4)) 72 hoursAn app that experiences a personal data breach affecting an individual in Thailand must notify the Personal Data Protection Committee's Office without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the affected individuals; where the breach is likely to cause high risk, the app must also notify each affected individual without delay. Status since 1 Jun 2022Read from the law library 29 August 2026
Vietnam	Law on Personal Data Protection, breach notification (Law No. 91/2025/QH15, Article 23) 72 hoursAn app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours. Status since 1 Jan 2026Read from the law library 15 October 2026

The Americas outside the United States Show the 14 provisionsHide the 14 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Barbados	Data Protection Act, 2019, personal data breach notification (Data Protection Act, 2019, ss. 63-64 (personal data breach notification)) 72 hoursNotify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later. 72 hoursCommunicate a personal data breach likely to result in a high risk to the rights and freedoms of individuals to the affected data subject, in clear and plain language, without undue delay and, where feasible, not later than 72 hours after becoming aware of it. without undue delayAs a data processor, notify the data controller without undue delay after becoming aware of a personal data breach. Status since 26 Mar 2021Read from the law library 19 September 2026
Belize	Data Protection Act 2021, personal data breach notification (Data Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62) 72 hoursWhere feasible, notify the Data Protection Commissioner of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to risk a person's rights and freedoms. 70 hoursWhere a personal data breach is likely to result in a high risk to a person's rights and freedoms, notify that person without undue delay and, where feasible, not later than 70 hours after becoming aware of it. Status from a date not yet setRead from the law library 5 September 2026
Canada	PIPEDA breach of security safeguards regime (S.C. 2000, c. 5, ss. 10.1-10.3) as soon as feasibleReport any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual. Status since 1 Nov 2018Read from the law library 2 September 2026
Ontario	Personal Health Information Protection Act, 2004, breach notification by custodians and agents (S.O. 2004, c. 3, Sched. A, ss. 12 (2)-(3), 17 (4), 17.1; O. Reg. 329/04, ss. 6.3-6.4) 30 daysIf you employ a health care practitioner who is a member of a College and the practitioner is terminated, suspended or disciplined because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or resigns and you have reasonable grounds to believe the resignation is related to an investigation of that conduct, give the College written notice within 30 days of the event. 30 daysIf you are the medical officer of health of a board of health and a health care practitioner who is a member of a College is employed to provide health care for the board as your agent, give the College written notice within 30 days of the event if the agent's employment is terminated or suspended or the agent is subject to disciplinary action because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or the agent resigns and you have reasonable grounds to believe the resignation is related to an investigation of that conduct. 30 daysIf you extend privileges to, or are otherwise affiliated with, a health care practitioner who is a member of a College, give the College written notice within 30 days of the event if the practitioner's privileges or affiliation are revoked, suspended or restricted because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or the practitioner relinquishes or restricts them and you have reasonable grounds to believe that is related to an investigation of that conduct. Status since 1 Oct 2017Read from the law library 1 October 2026
Quebec	Confidentiality incident notification and register (CQLR c P-39.1, ss. 3.5-3.8) promptlyWhere the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, promptly notify the Commission d’accès à l’information and each person whose personal information is concerned. Status since 22 Sep 2022Read from the law library 24 September 2026
Ecuador	LOPDP, notificación de vulneración de seguridad (LOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad)) 5 daysNotify the Authority and the telecommunications regulator of a personal-data security breach as soon as possible and no later than five days after becoming aware of it. 3 daysNotify the affected data subject within 3 days of learning of the risk, where the breach carries a risk to their fundamental rights and individual freedoms. 2 daysAs a processor, notify the controller of any personal-data security breach as soon as possible and within 2 days of learning of it. 5 daysGive the reasons for the delay where your notification to the Authority is later than the five days article 43 allows. Status since 26 May 2021Read from the law library 19 September 2026
Jamaica	Data Protection Act, 2020, reporting a contravention or security breach (Data Protection Act, 2020 (Act 7 of 2020), ss. 21(2)-(5), 30(1)(b), (4)-(5)) 72 hoursReport any security breach in respect of your operations which affects or may affect personal data, and any contravention of the data protection standards, to the Information Commissioner within 72 hours of becoming aware of the breach or contravention, in the prescribed form and manner. without undue delayNotify the Information Commissioner without undue delay of any breach of your security measures which affects or may affect personal data. upon becoming awareNotify each data subject whose personal data is affected by the breach, upon becoming aware of the breach or having reason to become aware of it, of the nature of the breach, of the measures taken or proposed to address it, and of your data protection officer's contact information, in the form, manner and time prescribed. Status since 1 Dec 2023Read from the law library 19 September 2026
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach notice (LFPDPPP, art. 19 (security-breach notice)) immediatelyNotify the affected data subject immediately of the breach, occurring at any stage of processing personal data, that significantly affects their patrimonial or moral rights. Status since 21 Mar 2025Read from the law library 19 September 2026
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, security incident notice (Ley No. 787, art. 11 (security incident notice to the affected institution)) immediatelyWhere the personal data affected belong to a member of the National Police or the Army of Nicaragua, and the security measures the law requires fail or are not observed, immediately inform the affected institution of the breach. Status since 29 Mar 2012Read from the law library 19 September 2026
Panama	Ley 81 de 2019, personal data breach notification (Ley 81 de 2019, arts. 2(5) and 26 (duty to notify security breaches)) as soon as possibleNotify the affected data subject as soon as possible after learning that their personal data was stolen without authorization or that its security was otherwise compromised. This Law sets no fixed number of hours or days for that notice and no duty to notify ANTAI of the breach. Status since 29 Mar 2021Read from the law library 19 September 2026
Paraguay	Ley N° 7593/2025, notificación de un incidente de seguridad (Ley 7593/2025, art. 17 (notificacion de un incidente de seguridad)) 72 hoursNotify the National Data Protection Agency, and the affected person where relevant, of a security incident within 72 hours of becoming aware of it. Status from 27 Nov 2027, in 13 monthsRead from the law library 19 September 2026
Suriname	Draft Law on the Protection of Privacy and Personal Data, breach notification (Art. 20 Wet Bescherming Privacy en Persoonsgegevens) 72 hours72 hoursNotify the Commissioner for Personal Data Protection of a breach relating to personal data without delay, and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; if you do not notify within 72 hours, state the reasons for the delay. without unreasonable delayAs a processor, inform the controller without unreasonable delay after becoming aware of a breach relating to personal data. Status proposedRead from the law library 19 September 2026
El Salvador	Ley para la Protección de Datos Personales, personal data breach notification (Decreto Legislativo No. 144, art. 25 (personal data breach notification)) 72 hoursNotify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and every affected data subject of a personal data breach within seventy two hours of becoming aware of it. Status since 23 Nov 2024Read from the law library 19 September 2026
Uruguay	Ley N° 19.670, personal data breach notification (Ley N° 19.670, de 15 de octubre de 2018, art. 38, reglamentado por Decreto N° 64/020, de 2020 (notificación de vulneración de seguridad)) immediatelyNotify the affected data subjects immediately and in detail on becoming aware of the breach, describing the measures adopted to address it. 72 hoursNotify the Unidad Reguladora y de Control de Datos Personales immediately and in detail on becoming aware of the breach, and in any event within 72 hours of becoming aware of it, coordinating your response with the national cybersecurity incident response center (CERTuy). Status since 1 Jan 2019Read from the law library 19 September 2026

Africa Show the 28 provisionsHide the 28 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité (Loi n°2017-20 du 20 avril 2018, Livre V, art. 427 (notification des ruptures de sécurité)) without delayNotify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data. without delayAs a processor, warn the controller without delay of any security breach affecting personal data you process on the controller's behalf. Status in forceRead from the law library 19 September 2026
Botswana	Data Protection Act, 2024, personal data breach notification (Data Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64) 72 hoursNotify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the affected person's rights and freedoms, and give reasons for any later notification. without undue delayAs a data processor, notify the data controller of a personal-data breach without undue delay after becoming aware of it. without undue delayCommunicate a high-risk personal-data breach to the affected data subject without undue delay. Status since 14 Jan 2025Read from the law library 19 September 2026
Democratic Republic of the Congo	Digital Code, Title III, personal data breach notification (Code du numérique, Titre III, art. 244 (violation de données à caractère personnel)) without delayNotify the Data Protection Authority and the affected data subject without delay of any breach affecting personal data, describing the nature of the breach, the categories and approximate number of affected people and records where possible, a contact point, the likely consequences, and the measures taken or proposed to address it. without delayAs a processor, warn the controller without delay of any breach of security affecting personal data you process on the controller's behalf. Status since 13 Mar 2023Read from the law library 19 September 2026
Republic of the Congo	Law No. 29-2019, personal-data breach notification (Loi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel)) 72 hoursNotify the national commission of a personal-data breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons. without undue delayCommunicate the breach to the affected data subject without undue delay, in clear and simple terms, where it is likely to create a high risk to their rights and freedoms. without undue delayAs a processor, notify the controller of any personal-data breach without undue delay after becoming aware of it. Status in forceRead from the law library 19 September 2026
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, personal data breach notification (Lei n.º 133/V/2001, de 22 de Janeiro, arts. 27 and 28 as republished by Lei n.º 121/IX/2021, de 17 de Março (violação de dados pessoais)) 72 hoursNotify the CNPD of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals' rights, freedoms and guarantees at risk, and state the reasons for the delay if you notify later (Article 27(1) and (2)). without undue delayIf you are a processor, notify the controller without undue delay of any personal data breach you become aware of (Article 27(6)). without undue delayCommunicate a personal data breach likely to result in a high risk to a data subject's rights, freedoms and guarantees to that data subject without undue delay, in clear and plain language, describing its nature, likely consequences and the measures taken or proposed, unless you applied appropriate protection measures to the affected data, have taken later measures that make the high risk no longer likely, or the effort would be disproportionate, in which case inform data subjects by an equally effective means such as a public communication (Article 28). Status since 17 Apr 2021Read from the law library 17 October 2026
Djibouti	Digital Code, Book I: personal-data breach notification (Code Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité)) 72 hoursNotify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window. without undue delayTell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms. without undue delayAs a processor, notify the controller of a personal-data breach without undue delay after becoming aware of it. Status since 7 Jul 2025Read from the law library 19 September 2026
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données (Loi n° 18-07 du 10 juin 2018, art. 43, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 45 bis 8 et 45 bis 10) without delayAs a service provider, that is any public or private entity offering users the ability to communicate over a computer or telecommunications system, or any entity processing or storing data for that communication service, notify the ANPDP without delay of a personal-data breach occurring on a public electronic communications network. without delayNotify the affected individual without delay of that same breach where it may harm their private life, unless the ANPDP finds you had already implemented appropriate protective measures. 5 daysIf you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, notify the ANPDP of a personal-data breach within five days of becoming aware of it, stating the reason for the delay if the notification is made later. Status since 11 Aug 2023Read from the law library 19 September 2026
Egypt	Egypt Personal Data Protection Law, Personal Data Infringement notification (Law No. 151 of 2020, Article 7 (Personal Data Infringement notification)) 72 hoursNotify the Personal Data Protection Center of any personal data breach within 72 hours of the breach, and notify immediately where the breach relates to national security protection concerns. 3 daysNotify the Data Subject within 3 days of the date you notified the Center, telling them of the infringement and the procedures you have adopted about it. Status since 16 Oct 2020Read from the law library 19 September 2026
Ethiopia	Personal Data Protection Proclamation, personal data breach notification (Proclamation No. 1321/2024, arts. 43-44 (personal data breach notification)) 72 hoursNotify the Authority of a personal data breach within 72 hours of becoming aware of it, giving reasons for any delay. 72 hoursCommunicate a personal data breach to the affected data subject within 72 hours of becoming aware of it, in clear language, describing the likely consequences, the contact point for more information and the measures taken to address it. without undue delayAs a data processor, notify the data controller without undue delay after becoming aware of a personal data breach. Status since 24 Jul 2024Read from the law library 19 September 2026
Gabon	Law No. 025/2023, personal-data breach notification (Loi n°025/2023, articles 142 à 147 (violation de données à caractère personnel)) without delayNotify the APDPVP without delay of a personal-data breach, describing its nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address it; the law sets no numeric deadline for this notice. without delayAs a processor, notify the controller without delay of a personal-data breach as soon as you become aware of it. as soon as possibleWhere a breach is likely to create a high risk to a person's rights and freedoms, inform the affected person as soon as possible, in clear and simple terms, giving at least the same information given to the APDPVP. Status since 15 Jul 2023Read from the law library 19 September 2026
Ghana	Data Protection Act, notification of security compromises (Data Protection Act, 2012 (Act 843), s. 31 (notification of security compromises)) as soon as reasonably practicableNotify the Data Protection Commission and the affected data subject as soon as reasonably practicable after you have reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person. Status since 16 Oct 2012Read from the law library 19 September 2026
Gambia	Personal Data Protection and Privacy Act, 2025, personal data breach notification (Personal Data Protection and Privacy Act, 2025, breach notification) 72 hoursNotify the Information Commission of a personal data breach within 72 hours of becoming aware of the breach. without undue delayNotify each affected data subject of a personal data breach without undue delay where the breach carries a high risk to their rights. Status from a date not yet setRead from the law library 19 September 2026
Kenya	Data Protection Act, 2019, personal data breach notification (Data Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach)) 72 hoursNotify the Data Commissioner within seventy-two hours of becoming aware of a personal data breach that carries a real risk of harm, giving reasons if you notify later. 48 hoursAs a data processor, notify the data controller within forty-eight hours of becoming aware of a breach where reasonably practicable, and otherwise without delay (section 43(3)). Status since 25 Nov 2019Read from the law library 4 September 2026
Lesotho	Data Protection Act, 2011, notification of security compromises (Data Protection Act, 2011, s. 23 (notification of security compromises)) as soon as reasonably possibleNotify the Data Protection Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established. Status since 22 Feb 2012Read from the law library 19 September 2026
Mauritius	Data Protection Act 2017, personal data breach notification (Data Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach)) 72 hoursNotify the Data Protection Commissioner without undue delay, and where feasible within 72 hours, of becoming aware of a personal data breach, giving reasons if notification is later. without undue delayCommunicate a personal data breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, unless an exception in section 26(3) applies. Status since 15 Jan 2018Read from the law library 5 September 2026
Niger	Loi n° 2022-59, notification des violations de données (Loi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel)) without delayNotify the HAPDP of a personal data breach without delay after becoming aware of it, and justify to the HAPDP any notification made outside that timeframe. as soon as possibleNotify the affected person of a personal data breach as soon as possible when it is likely to create a high risk to their rights and freedoms; you need not notify the person where it is reasonable to believe the breach creates no such risk. 72 hoursAs a data processor, notify the controller of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it. Status in forceRead from the law library 19 September 2026
Nigeria	Nigeria Data Protection Act, 2023, data breach notification (Nigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33)) 72 hoursNotify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned. immediatelyNotify affected data subjects immediately after becoming aware of a breach likely to result in a high risk to their rights and freedoms. Status since 12 Jun 2023Read from the law library 19 September 2026
Rwanda	Law relating to the Protection of Personal Data and Privacy, personal data breach notification (Law N° 58/2021, arts. 43-45 (personal data breach notification)) 48 hoursNotify the supervisory authority of the breach within 48 hours of becoming aware of it. 48 hoursAs a data processor, notify the data controller of the breach within 48 hours of becoming aware of it. 72 hoursSubmit a full report on the breach to the supervisory authority within 72 hours, describing its nature, the contact point for more information, the measures taken to address it, and your proposal and timeline for communicating it to affected data subjects. Status since 15 Oct 2021Read from the law library 19 September 2026
Seychelles	Data Protection Act, 2023, personal data breach notification (Data Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach)) 72 hoursNotify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, giving reasons for any later notification. promptlyPromptly inform the affected data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms. Status since 22 Dec 2023Read from the law library 6 September 2026
Somalia	Data Protection Act, 2023, personal data breach notification (Data Protection Act, Law No. 005 of 2023, arts. 25-27 (data breach notifications)) 72 hoursNotify the Data Protection Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within 72 hours after becoming aware of it. without undue delayCommunicate a breach likely to result in a high risk to a data subject to each affected data subject without undue delay, in plain and clear language, or through widely used media where direct communication would take disproportionate effort or expense. Status in forceRead from the law library 19 September 2026
Eswatini	Data Protection Act, 2022, notification of security compromises (Data Protection Act, 2022, s. 17 (notification of security compromises)) as soon as reasonably possibleNotify the Eswatini Communications Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established. Status since 4 Mar 2022Read from the law library 19 September 2026
Chad	Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICE (Loi n°007/PR/2015 du 10 février 2015, art. 61) without delayNotify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data. Status since 10 Feb 2015Read from the law library 7 September 2026
Tanzania	Personal Data Protection Act, 2022, security and breach notification (Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data)) without undue delayNotify the Personal Data Protection Commission without undue delay of any security breach affecting personal data you process. Status since 1 May 2023Read from the law library 6 September 2026
Uganda	Data Protection and Privacy Act, 2019, breach notification (Data Protection and Privacy Act, 2019, s. 23 (breach notification)) immediatelyNotify the National Information Technology Authority immediately after you believe personal data has been accessed or acquired by an unauthorised person, describing the access or acquisition and the remedial action taken. Status since 3 May 2019Read from the law library 19 September 2026
South Africa	Protection of Personal Information Act, notification of security compromises (POPIA, s. 22 (notification of security compromises)) as soon as reasonably possibleNotify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard. as soon as reasonably possibleNotify the affected data subject of the same security compromise as soon as reasonably possible after discovery, in writing, unless a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation, or the data subject's identity cannot be established. immediatelyAs an operator, notify the responsible party immediately once you have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Status since 1 Jul 2020Read from the law library 19 September 2026
Zambia	Data Protection Act, 2021, notification of a security breach (Data Protection Act, 2021, s. 49 (notification of a security breach)) 24 hoursNotify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it. as soon as practicableNotify the affected data subject as soon as practicable of any security breach affecting their personal data. as soon as practicableAs a data processor, notify the data controller as soon as practicable of any security breach affecting personal data you process on its behalf. Status since 1 Apr 2021Read from the law library 19 September 2026
Zimbabwe	Cyber and Data Protection Act, security breach notification (Cyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification)) 24 hoursNotify the Data Protection Authority within 24 hours of discovering a security breach affecting personal data you process. Status since 11 Mar 2022Read from the law library 19 September 2026
Zimbabwe	Cyber and Data Protection Regulations 2024, security breach notification (Statutory Instrument 155 of 2024, regulation 17 (security breach notification)) 24 hoursReport a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule. 72 hoursInform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms. 21 daysFinish the data breach investigation and submit your report within 21 days from the date of notification. Status since 13 Sep 2024Read from the law library 19 September 2026

The Middle East Show the 8 provisionsHide the 8 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
United Arab Emirates	ADGM Data Protection Regulations, breach notification (ADGM Data Protection Regulations 2021, personal data breach notification provisions) 72 hoursAn app that is a controller or processor established in or targeting the ADGM free zone and that suffers a personal data breach must notify the Commissioner of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to individuals' rights. Status since 14 Feb 2021Read from the law library 29 August 2026
United Arab Emirates	Federal Decree-Law on the Protection of Personal Data, breach notification (Federal Decree-Law No. 45 of 2021, Art. 9) at the time it becomes awareAn app that suffers a breach affecting the personal data of an individual in the onshore UAE must notify the Bureau at the time it becomes aware of the breach; the Decree-Law defers the specific notification window to Executive Regulations whose text could not be confirmed at primary source, so an app should not assume a specific hour count without checking current regulator guidance. Status since 2 Jan 2022Read from the law library 29 August 2026
Israel	Protection of Privacy Law, breach notification duty (Privacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21)) immediatelyAn app that suffers a severe security incident affecting the personal data of a person in Israel must immediately notify the Head of the Privacy Protection Authority under the Data Security Regulations' Art. 11(d)(1) duty; the regulations' own text, including any data-subject notification duty, is not set out here and should be confirmed directly before relying on it for full compliance detail. Status since 8 May 2018Read from the law library 29 August 2026
Jordan	Personal Data Protection Law, breach notification (Law No. 24 of 2023, Art. 20) 24 hours72 hoursAn app that suffers a serious breach of data security or safety that could cause significant harm to an individual in Jordan must notify the affected individuals within 24 hours of discovery and must notify the Unit within 72 hours of discovery with the source, mechanism, and affected individuals; a Controller found grossly negligent or engaged in misconduct in a breach is liable to compensate the affected Data Subject. Status since 17 Mar 2024Read from the law library 29 August 2026
Oman	Personal Data Protection Law, breach notification (Royal Decree No. 6/2022, Art. 19, breach notification provision) 72 hours72 hoursAn app that suffers a breach leading to the destruction, alteration, disclosure, access, or illegal processing of an individual's personal data in Oman must notify the Ministry and the affected Data Subject, following the procedure the Executive Regulations set; the Ministry's guidance puts the notice to the Ministry at 72 hours from awareness of a breach that threatens data subjects' rights, and the notice to the Data Subject at 72 hours where the breach poses serious harm or high risk. Status since 13 Feb 2023Read from the law library 21 October 2026
Qatar	Personal Data Privacy Protection Law, breach notification (Law No. 13 of 2016, Arts. 13-14) 72 hoursAn app that is a Processor handling the personal data of an individual in Qatar, including a voiceprint or faceprint, must forthwith notify its Controller of any breach or risk of one, and a Controller must inform the affected individual and the Competent Department where a breach of security precautions may cause serious damage to the data or the individual's privacy; the National Cyber Governance and Assurance Affairs' guideline requires that notice within 72 hours of becoming aware of the breach. Status since 1 Jan 2017Read from the law library 29 August 2026
Saudi Arabia	Personal Data Protection Law, breach notification (Royal Decree No. M/19, Art. 20) upon knowingAn app that suffers a breach, damage, or illegal access affecting the personal data of an individual in Saudi Arabia must notify the Competent Authority upon knowing of the breach, and must separately notify the Data Subject where the breach would cause damage to their data or prejudice their rights and interests, following the Implementing Regulations' procedure. Status since 14 Sep 2023Read from the law library 29 August 2026
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notification (Law No. 12 of 2024, art. 8 (personal data breach notification)) immediatelyNotify the Authority immediately on becoming aware of the breach, and expect the Authority to immediately notify the competent authorities where the breach concerns national security matters. 72 hoursNotify the Authority within 72 hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's contact details, the breach's likely effects, the measures taken or proposed to address it, and documentation of the breach and the corrective action taken. 3 business daysTell the affected data subject what measures have been taken within three working days of the date you notified the Authority of the breach. Status since 1 Jan 2025Read from the law library 19 September 2026

Elsewhere Show the 24 provisionsHide the 24 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Andorra	LQPD, personal data breach notification (Llei 29/2021, arts. 36-37 (personal data breach notification)) 72 hoursNotify the Andorran Data Protection Agency of a personal data breach without undue delay and, where possible, within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. 72 hoursJustify the reasons for the delay if notifying the Agency after that seventy-two-hour period. without delayAs a data processor, notify the data controller without delay of a personal data breach you become aware of. without undue delayCommunicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 37(3) exception applies. without undue delayDescribe in the Agency notification the nature of the breach, the categories and approximate number of data subjects and records affected where possible, a contact point, the likely consequences, and the measures taken or proposed, supplying information in phases without undue delay where it cannot all be given at once. Status since 17 May 2022Read from the law library 19 September 2026
Albania	Law No. 124/2024, notification of a personal data breach (Law No. 124/2024, Art. 29 (notification of a personal data breach)) 72 hoursNotify the Commissioner of a personal data breach as soon as possible and no later than 72 hours of becoming aware of the breach, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and give the Commissioner your reasons for any later notification. immediatelyAs a processor, notify the controller immediately after becoming aware of any personal data breach. as soon as possibleDescribe in the notification to the Commissioner the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, supplying anything you cannot give at once as soon as possible afterward. Status since 31 Jan 2025Read from the law library 19 September 2026
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification (Law on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification)) 72 hoursNotify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later. without undue delayAs a processor, notify the controller without undue delay after becoming aware of a personal data breach. without delayNotify the affected person of a personal data breach without delay, in writing and in clear language, wherever the breach is likely to result in a high risk to that person's rights and freedoms, unless the data were rendered unintelligible, the high risk can no longer materialize, or notice would take disproportionate effort and a public notice reaches the person as effectively. 72 hoursAs a competent authority processing personal data for a criminal-law purpose, notify the Agency of a breach without delay and no later than 72 hours after becoming aware of it, and the affected person without delay under the same high-risk test, and pass the breach information to the data controller of another country without undue delay wherever the breached data were transmitted by or to it. Status since 4 Oct 2025Read from the law library 19 September 2026
Bermuda	Personal Information Protection Act 2016, breach of security notification (Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security)) without undue delayNotify the Privacy Commissioner, then any affected individual, without undue delay of a breach of security that is likely to adversely affect an individual. Status since 1 Jan 2025Read from the law library 7 September 2026
Belarus	Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations (Law No. 99-Z, art. 16.1 (notification of personal data protection violations)) 3 business daysNotify the National Center for Personal Data Protection immediately, and in any case no later than three working days after becoming aware of a violation of your personal data protection systems, under Article 16, unless the Center itself provides otherwise. Status since 15 Nov 2021Read from the law library 19 September 2026
Switzerland	FADP Article 24, Breach Notification in Switzerland (Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24) as soon as possibleNotify the FDPIC as soon as possible once you become aware of a data security breach likely to result in a high risk to a Swiss data subject's personality or fundamental rights. Status since 1 Sep 2023Read from the law library 24 August 2026
Georgia	Law on Personal Data Protection, breach notification (Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 (17 December 2025)) 72 hoursAn app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights. Status since 1 Mar 2024Read from the law library 29 August 2026
Iceland	Act No. 90/2018, Breach Notification in Iceland (Log nr. 90/2018 (breach notification provisions)) 72 hoursNotify Personuvernd without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Iceland, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 15 Jul 2018Read from the law library 24 August 2026
Kiribati	Data Protection Act 2025, personal data breaches (Data Protection Act 2025, ss. 19-20 (personal data breaches)) as soon as practicableNotify the Digital Transformation Office of a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, as soon as practicable after becoming aware of the breach. as soon as practicableNotify each affected data subject of that same harmful personal data breach as soon as practicable after becoming aware of the breach, or by public notification through widely used media where direct notification is not feasible or would involve disproportionate effort or expense. as soon as practicableAs a person processing personal data on another person's behalf, inform that other person as soon as practicable after becoming aware of any personal data breach, regardless of whether it meets the significant-harm threshold for notifying the Office and data subjects. Status since 20 Aug 2026Read from the law library 19 September 2026
Cayman Islands	Data Protection Act 2021 Revision, personal data breach notification (Data Protection Act (2021 Revision), s. 16 (personal data breaches)) 5 daysNotify the Ombudsman and each affected data subject of a personal data breach without undue delay and no later than five days after you should, with the exercise of reasonable diligence, have been aware of it, describing the breach, its consequences, and the measures taken or recommended (section 16(1)). Status since 30 Sep 2019Read from the law library 7 September 2026
Liechtenstein	DSG Breach Notification in Liechtenstein (Regulation (EU) 2016/679, Articles 33 and 34; Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 43, 64 and 65) 72 hoursNotify the competent supervisory authority, the Datenschutzstelle in Liechtenstein, of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. without undue delayCommunicate a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons to the data subjects without undue delay. Status since 1 Jan 2019Read from the law library 24 August 2026
Monaco	Loi sur la Protection des Données Personnelles, notification des violations de données (Loi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification)) 72 hoursNotify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to create a risk to the rights and freedoms of the persons concerned, and give the reasons for the delay when you notify later than that. as soon as possibleCommunicate a personal data breach to the affected person as soon as possible, in clear language, when it is likely to create a high risk to their rights and freedoms. Status since 13 Dec 2024Read from the law library 19 September 2026
Moldova	Moldova Law No. 195/2024, personal data breach notification (Legea Nr. 195 din 25 iulie 2024, articolele 33-34 (notificarea incalcarii securitatii datelor)) 72 hoursNotify the National Centre for Personal Data Protection without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Moldova, unless the breach is unlikely to risk their rights and freedoms. without undue delayCommunicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language. without undue delayAs a processor, notify the controller without undue delay after becoming aware of a personal data breach. Status since 23 Aug 2026Read from the law library 19 September 2026
North Macedonia	Law on Personal Data Protection (LPDP), personal data breach notification (Zakon za zastita na licnite podatoci, arts. 37-38 (personal data breach notification)) 72 hours72 hoursNotify the Agency of a personal data breach immediately and no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and give reasons for any delay beyond 72 hours. immediatelyAs a processor, notify the controller immediately after becoming aware of a personal data breach. immediatelyNotify the affected data subject immediately of a personal data breach likely to cause a high risk to their rights and freedoms, unless an exception such as prior encryption, later mitigation, or disproportionate effort applies. Status since 24 Aug 2021Read from the law library 19 September 2026
Maldives	Maldives Personal Data Protection Bill, personal data breach notification (Personal Data Protection Bill, section 34 (personal data breach notification)) 72 hoursA Controller must notify the Data Protection Authority within 72 hours of coming to know of, or reasonably believing in, a personal data breach involving special categories of personal data or data that could enable identity theft or fraud. Status proposedRead from the law library 19 September 2026
Norway	Personal Data Act, Breach Notification in Norway (personopplysningsloven LOV-2018-06-15-38, breach notification provisions) 72 hoursNotify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Norway, unless the breach is unlikely to risk their rights and freedoms. without undue delayNotify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Status since 20 Jul 2018Read from the law library 24 August 2026
Serbia	Law on Personal Data Protection, personal data breach notification (Law on Personal Data Protection, arts. 52-53 (personal data breach notification), Official Gazette RS No. 87/2018) 72 hours72 hoursNotify the Commissioner of a breach that may create risk to a person's rights and freedoms without undue delay, and within 72 hours of becoming aware of the breach where that is possible; give reasons for any delay beyond 72 hours. without undue delayAs a processor, notify the controller without undue delay after becoming aware of a breach. without undue delayNotify the affected person of a breach without undue delay, in clear language, whenever the breach may create high risk to their rights and freedoms. Status since 22 Aug 2019Read from the law library 19 September 2026
Russia	Federal Law No. 152-FZ, Article 21 Part 3.1, Breach Notification (Federal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force 1 September 2022)) 24 hours72 hoursNotify Roskomnadzor within 24 hours of detecting an unlawful or accidental transfer, provision, distribution, or access to personal data of a person in Russia, and file a full follow-up report within 72 hours. Status since 1 Sep 2022Read from the law library 24 August 2026
San Marino	San Marino Law No. 171, personal data breach notification (Legge 21 dicembre 2018 n. 171, articoli 34-35 (violazione dei dati personali)) 72 hoursNotify the Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in San Marino, under Article 34. without undue delayCommunicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language. without undue delayAs a processor, notify the controller without undue delay after becoming aware of a personal data breach. Status since 5 Jan 2019Read from the law library 19 September 2026
Tonga	Privacy Act 2025, personal information breaches (Privacy Act 2025, s. 37 (personal information breaches)) 72 hoursNotify the Privacy Commission within 72 hours of becoming aware of a personal information breach that is likely to result in a risk to the rights and freedoms of individuals, describing its nature and, where possible, the categories and approximate numbers of data subjects and records concerned. 72 hoursAs a data processor, notify the data controller or the data processor that engaged you within 72 hours of becoming aware of a personal information breach, and answer their information requests without undue delay. without undue delayCommunicate a breach likely to result in a high risk to a data subject to that person without undue delay, in plain and clear language, with advice on how to mitigate the effects, or through widely used media where direct communication would take disproportionate effort or expense. Status from a date not yet setRead from the law library 19 September 2026
Turkey	Personal Data Protection Law (KVKK), breach notification (Law No. 6698, Art. 12(5)) 72 hoursAn app that suffers unlawful acquisition of personal data belonging to a person in Turkey must notify the affected data subject and the Board within the shortest time; Board Decision 2019/10 of 24 January 2019 reads that as notice to the Board without delay and at the latest within 72 hours of learning of the breach, and notice to each affected data subject within the shortest reasonable time after the data subject is identified. Status since 7 Apr 2016Read from the law library 29 August 2026
Ukraine	Draft Law No. 8153, personal data breach notification (Draft Law No. 8153, 72 hour breach notification to the National Commission) 72 hoursNotify the supervisory authority of a personal data breach within 72 hours of becoming aware of it. Status proposedRead from the law library 19 September 2026
Samoa	National Digital Identification Act 2024, personal data breach notification (National Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification)) 72 hoursAs a relying party or data processor in the National Digital Identification System, notify the Registrar General of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of records concerned. without undue delayWhere a personal data breach is likely to result in a high risk to a registered person's rights, ensure the Registrar General can communicate the breach to that person without undue delay, in plain language, with advice on mitigating measures. Status since 5 Feb 2024Read from the law library 7 September 2026
Kosovo	Law No. 06/L-082 on Protection of Personal Data, personal data breach notification (Law No. 06/L-082 on Protection of Personal Data, arts. 33-34 (personal data breach notification)) 72 hoursNotify the Agency for Information and Privacy of a personal data breach without delay and, where feasible, no later than seventy-two hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. 72 hoursGive reasons for the delay if notifying the Agency after that seventy-two-hour period. without undue delayAs a data processor, notify the data controller without undue delay after becoming aware of a personal data breach. without undue delayCommunicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 34(3) exception applies. Status since 12 Mar 2019Read from the law library 19 September 2026