The incident clock

Every reporting clock in the LexLint law library that an incident involving an agent can start: the incident and vulnerability duties of cybersecurity law and the breach duties of privacy law, by jurisdiction, each with the sentence that carries the clock, and the Open Secure AI Alliance's proposed SAFE timeline drawn on the same scale.

An incident involving an AGENT, a credential it leaked, a tool it misused, a system it took down, a person's data it exposed, starts clocks in the law of every jurisdiction where the affected systems and people are. None of those clocks was written for agents. They are the incident and vulnerability reporting duties of cybersecurity law and the breach notification duties of privacy law, and the law library holds them by jurisdiction, each with the sentence that carries the clock and a link to the primary source.

This page lists them, and it draws the notification timeline of the Shared AI Findings Exchange (SAFE), the incident-learning working group of the Open Secure AI Alliance (OSAA), whose version 1.0 is dated 21 October 2026, on the same scale, because a member of that scheme would be reporting to a regulator and to the scheme from the same incident. Nothing here says which report an organization must file. It says which clocks exist, who set them, and where the text is.

1SAFE's timeline, and the statutory clocks beside it

The notification timeline of SAFE v1.0 sets six dated rungs and one recurring duty, quoted here as it writes them (source: the compact's text, dated 21 October 2026, read 22 October 2026). It says of itself that “SAFE reporting complements applicable legal, contractual and coordinated-disclosure duties; it does not replace or extend their deadlines.” Beside each rung are the statutory clocks in the law library that fall at or inside it: later than SAFE's previous rung, no later than this one. The first rung has no hours, so what sits there is every obligation stated as a standard rather than a number.

2Security law: incident and vulnerability reporting, by jurisdiction

313 instruments in 175 jurisdictions in the law library's cybersecurity topic under its incident-reporting family state a reporting deadline, as of 6 November 2026: 235 a numeric clock, and 78 a standard such as "immediately" or "without undue delay" with no number. Most bind the OPERATOR of a service inside the scope of the NIS2 Directive or its national transposition; the CRA binds the MAKER of a product with digital elements, software included. The sentence says which.

52 more instruments in this family state no deadline in their obligation lines and are not listed here; the cybersecurity law section has them.

European Union Show the 9 provisionsHide the 9 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
European Union	Commission Delegated Regulation (EU) 2022/1645, External Reporting of Information Security Incidents and Vulnerabilities (IS.D.OR.230) (Commission Delegated Regulation (EU) 2022/1645, IS.D.OR.230) 72 hoursSubmit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)). Status since 16 Oct 2025Read from the law library 10 October 2026
European Union	Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Information Sharing on Cyber-Attacks and Threats (Commission Delegated Regulation (EU) 2024/1366, Art. 38) 4 hoursShare relevant information related to a reportable cyber-attack with your CSIRTs and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)). without undue delayProvide your CSIRTs without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)). Status since 13 Jun 2024Read from the law library 10 October 2026
European Union	Commission Implementing Regulation (EU) 2023/203, External Reporting of Information Security Incidents and Vulnerabilities in Aviation (IS.I.OR.230) (Commission Implementing Regulation (EU) 2023/203, IS.I.OR.230) 72 hoursSubmit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)). Status since 22 Feb 2026Read from the law library 10 October 2026
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations (Regulation (EU) 2024/2847, Art. 14) 24 hours72 hours14 daysNotify the CSIRT designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided. 24 hours72 hours1 monthNotify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the CSIRT an intermediate report on relevant status updates if it asks for one. Status since 11 Sep 2026Read from the law library 12 October 2026
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301 (Regulation (EU) 2022/2554, Article 19) 4 hours24 hoursReport a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it. 4 hoursWhere classification as major comes later than that, submit the initial notification within four hours of the classification instead. 72 hoursSubmit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities. 1 monthSubmit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures. without undue delayIf you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report. Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level. without undue delayNotifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable. Status since 17 Jan 2025Read from the law library 20 September 2026
European Union	EUCC Certification Scheme, Vulnerability Impact Analysis Report and Disclosure (Commission Implementing Regulation (EU) 2024/482, Arts. 35 and 39) without undue delayTransmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)). Status since 27 Feb 2025Read from the law library 10 October 2026
European Union	European Health Data Space Regulation, Serious-Incident Reporting by Manufacturers of EHR Systems (Regulation (EU) 2025/327, Art. 44(7)) 3 daysMake the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)). Status from 26 Mar 2029, in 2.4 yearsRead from the law library 10 October 2026
European Union	NIS2 Directive, Reporting Obligations (Directive (EU) 2022/2555, Art. 23) 24 hours72 hours24 hours1 month1 monthNotify your CSIRT, or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling. without undue delayWhere appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take. Status since 18 Oct 2024Read from the law library 7 October 2026
European Union	eIDAS Regulation, Article 19a(1)(b): Notification of Security Breaches and Disruptions by Non-Qualified Trust Service Providers (Regulation (EU) No 910/2014, Article 19a(1)(b)) 24 hoursMake each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)). Status since 20 May 2024Read from the law library 10 October 2026

EU member states (the national layer) Show the 39 provisionsHide the 39 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Austria	Netz- und Informationssystemsicherheitsgesetz (NISG), Incident Notification Obligations (NISG, BGBl. I Nr. 111/2018, §§ 19 und 21) without delayNotify your competent Computer-Notfallteam (CERT), or, absent one, the national CERT or GovCERT, without delay of a security incident affecting the service you provide. Status since 29 Dec 2018 replacedRead from the law library 3 October 2026
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations (NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35) 24 hoursNotify your competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident: an early warning within 24 hours of becoming aware, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects. 72 hoursFollow with a fuller notification within 72 hours of becoming aware, updating the early warning with an initial evaluation of the incident's severity and impact and any indicators of compromise. 1 month1 monthSubmit an interim report on request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report no later than one month after you have finished handling the incident (Section 34(2)). 24 hoursIf you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant cybersecurity incident that affects your trust services (Section 34(2)). Status since 1 Oct 2026Read from the law library 3 October 2026
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations (Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 34-37) without undue delayNotify the national CSIRT of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre. 24 hoursSubmit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise. 1 monthSubmit an interim report if the national CSIRT or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact. 1 month1 monthIf the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5). 24 hoursIf you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2). Status since 18 Oct 2024Read from the law library 14 September 2026
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS) (Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026)) 24 hours72 hours24 hours1 month1 monthNotify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)). 72 hoursState in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect. without undue delayWhere appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature. Status since 17 Feb 2026Read from the law library 15 September 2026
Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations (Art. 35B of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025) 6 hoursNotify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available. 1 monthevery 15 days15 daysSubmit an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every fifteen days counted from the incident notification until the final report, and a final report within fifteen days of restoring the affected network or information system's normal operation). 24 hoursWhere you are a trust service provider, notify within 24 hours rather than 72 for a significant incident affecting the trust services you supply. without undue delayWhere applicable, notify without undue delay the recipients of your services who may be affected by a significant cyber threat, of any measures or corrective action they can take, and notify them of a significant incident likely to adversely affect their use of the service. Status since 25 Apr 2025Read from the law library 16 September 2026
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification (Act No. 264/2025 Coll., Cybersecurity Act, Sections 15-16) 24 hoursIf you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact. 24 hoursIf you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision. 72 hoursFor an incident with significant impact, follow with a report no later than 72 hours after detection that updates your initial assessment and gives the incident's impact and, where available, indicators of compromise. 24 hoursIf you provide a trust service under the directly applicable EU regulation, submit the notification of an incident with significant impact within 24 hours after detection, not 72. 30 days24 hours30 daysSubmit an interim report on request, and a final report no later than 30 days after submitting the notification under Section 16(3)(a) (the 72-hour notification, or the 24-hour one for a trust-service provider), or, if the incident is still ongoing at that point, a progress report followed by a final report within 30 days of resolution. Status since 1 Nov 2025Read from the law library 14 September 2026
Germany	BSI-Gesetz (BSIG), Incident Notification (BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I Nr. 318), § 32) 24 hoursNotify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect. 72 hoursFollow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 monthSubmit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it. Status since 6 Dec 2025Read from the law library 2 November 2026
Denmark	Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Significant Incident Notification (Lov nr. 435 af 6. maj 2025, §§ 8, 9 og 11) 24 hours72 hours1 month1 monthNotify the Danish Agency for Societal Security and the CSIRT of every significant incident: an early warning without undue delay and within 24 hours of becoming aware of it, stating whether it is suspected to be caused by unlawful or malicious acts or could have a cross-border effect; an incident notification within 72 hours; an interim report when the authority asks; and a final report within one month of the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Sections 8(2) and 9(1)). without undue delayTell the recipients of your services, without undue delay and to the relevant extent, when a significant incident is likely to affect their service negatively, and tell recipients potentially affected by a significant cyber threat of any measures they can take in response (Section 11). Status since 1 Jul 2025Read from the law library 2 November 2026
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties (NIS 2-loven, §§ 12-13, 15) 24 hoursSend an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect. 72 hoursFollow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available. 1 month1 monthSubmit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled. 24 hoursIf you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours. without undue delayNotify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant. Status since 1 Jul 2025Read from the law library 15 September 2026
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident (Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1) 24 hoursSubmit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority. 24 hoursWhere you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1). 72 hours24 hoursFollow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a trust service provider, in which case you submit it within 24 hours instead. 1 month1 monthSubmit an interim report if RIA asks for one, and a final report within one month of the incident report, or, if the incident is still unresolved at that point, treat that report as interim and submit a further final report within one month of resolution. Status since 1 Jan 2026Read from the law library 7 October 2026
Spain	Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Incident Reporting Obligations (Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555)) 24 hoursAs drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)). 72 hours24 hoursAs drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)). 1 month1 monthAs drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)). as soon as possibleAs drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take. Status proposedRead from the law library 12 September 2026
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation (Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero) without undue delayIf you are an operator of essential services, notify the competent authority, through your reference CSIRT, of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's. 24 hours48 hours20 days72 hours40 daysFor a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6). Status since 9 Sep 2018Read from the law library 12 September 2026
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations (Kyberturvallisuuslaki (124/2025), 11-14 ja 22 §) without delayNotify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage. 24 hours72 hours24 hoursFile an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72. 1 month1 month1 monthProvide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects. without delayNotify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it. Status since 8 Apr 2025Read from the law library 15 September 2026
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances (90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023)) without delayNotify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks you use that may significantly endanger the use of information systems or the provision of social and health care services; a pharmacy whose operations may be significantly endangered also notifies the Finnish Medicines Agency without delay (section 90). Status since 1 Jan 2024Read from the law library 12 October 2026
Finland	Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators (274 ja 275 §, Laki sähköisen viestinnän palveluista (917/2014)) without delayIf you are a telecommunications operator (teleyritys) providing a communications service in Finland, notify your subscribers and users without delay when a significant information-security breach, or another event that prevents the service from working or materially disturbs it, affects or threatens your service (Act 917/2014, section 274). without delayIf you provide a value-added service as a value-added service provider (lisäarvopalvelun tarjoaja), notify your users without delay of a significant information-security breach, or the threat of one, affecting your service (section 274). without undue delayAs a telecommunications operator, notify the Finnish Transport and Communications Agency without delay of the same kind of breach or event, then report without undue delay its estimated duration and effects, the corrective measures taken and the measures taken to prevent it recurring (section 275). Status since 1 Jan 2015Read from the law library 12 October 2026
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification (Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13) without delayDeclare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider). Status since 10 May 2018Read from the law library 12 September 2026
France	Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2) (Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents)) 24 hours72 hours1 month1 month1 monthIn the text the Sénat adopted, notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours of becoming aware of it updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month of the intermediate notification, or, where the incident is not yet handled by then, a progress report within one month of the intermediate notification and a final report within one month of the incident being handled (Article 17). 24 hours72 hours1 monthIn the text the Assemblée nationale's special committee deposited (n° 1779-A0), the initial notification within 24 hours, the intermediate notification within 72 hours and the final report within one month would be the same, but an incident would count as important only where it caused or is liable to cause a severe operational disruption or significant financial losses for you, or considerable material, physical or non-material damage to another person. without undue delayIn that committee text, where appropriate, notify the recipients of your services without undue delay of an important incident with a direct impact on them and of the measures or corrections they can apply against a critical vulnerability, and also inform them of the vulnerability itself, except for information whose disclosure would harm the interests of defense and national security. 24 hoursWhere you are a qualified trust-service provider (Article 8(4)) or a trust-service provider (Article 9(3)), send the intermediate notification within 24 hours rather than 72 for an incident affecting your trust services. Status proposedRead from the law library 12 October 2026
Greece	Law 5160/2024, Significant-Incident Reporting Obligations (Law 5160/2024 (Ν. 5160/2024), Art. 16) 24 hoursNotify the CSIRT of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects. 72 hoursFollow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects. 1 month1 monthSubmit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution. 24 hoursIf you are a trust-service provider, notify the National Cybersecurity Authority of a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour notification. without undue delayWithout undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response. Status since 27 Nov 2024Read from the law library 15 September 2026
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations (Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85.) 24 hours24 hours72 hours30 daysevery 30 days30 daysNotify the competent CSIRT of every significant incident on this clock, set by the Cybersecurity Regulation rather than the Act itself: an early warning without delay and no later than 24 hours after becoming aware of it (24 hours also for a trust service provider's initial notification), an initial notification no later than 72 hours otherwise, an interim report if the CSIRT requests one, and a final report no later than 30 days after your initial notification, or, if the incident is still unresolved at that point, a progress report instead, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of your last progress report. 48 hours7 daysSubmit an interim report to the CSIRT when it requests one, within the period the CSIRT sets, of no less than 48 hours and no more than seven days from receipt of the request. 72 hours72 hoursNotify the recipients of your service, without delay and no later than 72 hours after you become aware of a significant incident likely to affect them, in a clear and easily verifiable way, and send them any details that were not yet known within 72 hours of sending that notice. Separately notify them of a serious cyber threat and of any protective measures or remedies they can take. Status since 30 Nov 2024Read from the law library 16 September 2026
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine (2024. évi LXIX. törvény, 66. §; 418/2024. (XII. 23.) Korm. rendelet, 42. § és 77. §) 24 hours72 hours1 monthNotify the national cybersecurity incident-handling center (Nemzeti Kiberbiztonsági Intézet, the NKI) of a cyber threat, near-incident or cybersecurity incident affecting your electronic information system: an initial notification without undue delay and in any case within 24 hours of becoming aware, an event notification without undue delay and in any case within 72 hours of becoming aware that updates that report and assesses the incident's severity and impact, and a final report no later than one month after the event notification. 24 hoursIf you are a trust service provider, notify the center of a cybersecurity incident affecting your trust services without undue delay and in any case within 24 hours of becoming aware of it, in place of the event notification (Decree 418/2024, Section 77(4)). 1 monthSubmit an interim status report if the center asks for one, and, if the incident is still ongoing when the final report is due, a report on the results achieved so far followed by a final report within one month after you have finished handling the incident (Decree 418/2024, Section 77(1)). Status since 1 Jan 2025Read from the law library 12 October 2026
Ireland	European Union (NIS) Regulations 2018, Incident Notification (S.I. No. 360/2018, Regs. 18 and 22) 72 hoursNotify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on. 72 hoursNotify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)). Status since 18 Sep 2018Read from the law library 12 September 2026
Ireland	National Cyber Security Bill, Incident Response Powers and Reporting Obligations (Head 15, General Scheme, National Cyber Security Bill 2024) 24 hours72 hours1 monthNotify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15). 1 month1 monthWhere the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15). 24 hoursIf you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15). Status proposedRead from the law library 12 September 2026
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification (D.Lgs. 4 settembre 2024, n. 138, Art. 25) 24 hoursNotify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact. 72 hoursFollow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 monthevery month1 monthSubmit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution). 24 hoursWhere you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply. Status since 16 Oct 2024Read from the law library 12 September 2026
Italy	Legge 28 giugno 2024, n. 90, Incident Notification and Vulnerability Remediation Duties (Artt. 1 e 2, Legge 28 giugno 2024, n. 90) 24 hours72 hoursIf you are a central public administration, region, metropolitan city, large municipality or regional capital, urban or suburban public transport company, local health authority, or an in-house company providing IT, transport, wastewater or waste services for them, report any incident on the ACN taxonomy that affects your networks, information systems or IT services without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment (Law 90/2024, Article 1(1) and (2)). promptlyIf ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2). Status since 17 Jul 2024Read from the law library 12 October 2026
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification (Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of 11 July 2024, in force since 18 October 2024, and amended by Nr. XV-894 of 12 May 2026 and Nr. XV-1076 of 25 June 2026 (consolidated edition of 4 July 2026), Art. 18) 24 hoursNotify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it. 72 hours72 hoursFollow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning. 1 monthSubmit a final report within one month of the day you submitted the early warning (the notification in Article 18(4)(1)), and an interim report on NKSC's request within the deadline NKSC sets. 1 month1 monthIf the incident is still ongoing when the final report falls due, submit a progress report, and submit the final report within one month of the day the incident was contained. Status since 18 Oct 2024Read from the law library 7 October 2026
Luxembourg	Loi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability Notices (Art. 1, 5 et 6, Loi du 20 décembre 2024 (Mémorial A n° 604)) 72 hoursIf you hold a European cybersecurity certificate, issue an EU declaration of conformity, or are a conformity assessment body, inform ILNAS in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements linked to the certification of a product, service or process (Loi du 20 décembre 2024, Article 5(2)). 72 hoursIf you are an accredited conformity assessment body, inform ILNAS of your accreditation and of the certificates you issue within 72 hours (Article 6). Status since 31 Dec 2024Read from the law library 12 October 2026
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification (Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14) without undue delayNotify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person. 24 hoursSubmit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect. 72 hoursFollow with a fuller incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise. 1 month1 monthSubmit an intermediate report if a CSIRT or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4). without undue delayWhere appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat. 24 hoursIf you are a trust-service provider, notify a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour incident notification; the early warning, the intermediate report and the final report still apply. Status since 10 May 2026Read from the law library 14 September 2026
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation (Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti) 5 business daysWhere you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential. Status since 1 Sep 2024Read from the law library 7 October 2026
Latvia	Nacionālās kiberdrošības likums, Incident Notification (Nacionālās kiberdrošības likums (adopted 20.06.2024, notification clock applying from 01.07.2025), 34. pants) immediatelyImmediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (for most private-sector and civilian public-sector subjects, the Institute of Mathematics and Computer Science of the University of Latvia), and follow its instructions. 24 hoursFor a significant cyber incident, electronically submit an early warning to the competent institution without delay and no later than within 24 hours. 72 hours24 hoursFollow with an initial report without delay and no later than within 72 hours (within 24 hours instead, if you are a trust service provider). 1 monthWithin one month of the initial report, submit a final report on the incident's resolution, or, if it is still unresolved at that point, a progress report followed by a final report once you have resolved it; submit an intermediate report if the competent institution requests one. immediatelyWhere relevant, immediately inform your service recipients, including affected network or system users, of protective measures they can take, and, after coordinating with the competent institution, inform them of the significant incident or threat itself, unless disclosure would create a new significant-incident risk or conflict with national security. Status since 1 Jul 2025Read from the law library 7 October 2026
Malta	Electronic Communications Networks and Services (General) Regulations, Security Incident Notification to the Malta Communications Authority (L.N. 379 of 2021, reg. 28, Electronic Communications Networks and Services (General) Regulations) without undue delayNotify the Authority, the Malta Communications Authority, without undue delay of any security incident that has a significant impact on the operation of your networks or services (regulation 28(2)(a)). without undue delayIf you are a gateway operator, notify the Authority without undue delay of any failure or serious degradation of the connectivity you provide (regulation 28(2)(b)). Status since 1 Oct 2021Read from the law library 12 October 2026
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches (Malta Gaming Authority Directive 3 of 2018, Gaming Authorisations and Compliance Directive, art. 37(2)(c) and (d)) 3 business daysNotify the Authority forthwith, and in any case no later than three working days after the breach, of any breach of your information security that adversely affects the confidentiality of information relating to players (article 37(2)(c)). 3 business daysNotify the Authority on the same clock of any breach of your information security that precludes players from accessing their accounts for a period exceeding twelve hours (article 37(2)(d)). Status since 1 Aug 2018Read from the law library 29 September 2026
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT (S.L. 460.41, art. 20, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order) immediatelyNotify the national CSIRT, which article 8(1) establishes within the Malta Information Technology Agency, immediately of any incident that has a significant impact on the provision of your services; treat an incident as significant where it has caused or is capable of causing severe operational disruption of the service or financial loss for you, or considerable material or non-material damage to another person. 24 hoursSubmit an early warning to the national CSIRT, without undue delay and in any event within 24 hours of becoming aware of the significant incident, stating where applicable whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact. 72 hoursFollow with an incident notification within 72 hours of becoming aware of the incident, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, the indicators of compromise. 1 month1 monthSubmit an intermediate report on relevant status updates if the national CSIRT asks for one, and a final report not later than one month after the incident notification, covering a detailed description of the incident, its likely root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing then, send a progress report at that point and a final report within one month of handling it. without undue delayWhere appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response. 24 hoursIf you are a trust service provider, notify a significant incident that affects your trust services within 24 hours of becoming aware of it, without the 72-hour stage that applies to other entities. Status since 23 Jan 2026Read from the law library 29 September 2026
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations (Cyberbeveiligingswet, Artt. 25-29) 24 hoursGive your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects. 72 hours24 hoursFollow with a notification, without delay or, if that is not possible, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident's severity and effects. If you provide a trust service and the incident affects its provision, file this notification without delay or, if that is not possible, within 24 hours of becoming aware of the incident instead. 1 month1 monthSubmit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution. Status since 15 Aug 2026Read from the law library 2 November 2026
Poland	Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych (Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)) 24 hoursNotify the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning. 72 hours1 monthFollow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification. 24 hoursIf you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)). 1 month1 monthIf the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b). Status since 3 Oct 2026Read from the law library 14 September 2026
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations (Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º) 24 hours72 hoursSubmit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below. 24 hoursSubmit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending. 30 business daysevery weekSubmit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)). Status since 3 Apr 2026Read from the law library 15 September 2026
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification (Ordonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17) without undue delayReport to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC). 6 hoursReport to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)). 24 hours72 hours1 monthSubmit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the CSIRT requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point. 24 hoursIf you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock. Status since 31 Dec 2024Read from the law library 15 September 2026
Sweden	Cybersäkerhetslag, Incident Notification (Cybersäkerhetslag (2025:1506), 2 kap. 5-10 §§) 24 hoursInform the authority the government designates (in practice the CSIRT-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it. 24 hours72 hoursFollow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware. 1 month1 monthNo later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it. Status since 15 Jan 2026Read from the law library 15 September 2026
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations (Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 29-30) 24 hoursGive your competent CSIRT group an early warning without delay, at latest within 24 hours of detecting a significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect. 72 hours1 month1 monthFollow with a full notification without delay, at latest within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available threat indicators, then an interim report if the CSIRT group asks for one, and a final report at latest one month after the 72-hour notification, or a progress report and a final report within one month of resolution if the incident is still ongoing at that point. 24 hoursIf you are a trust service provider, notify your competent CSIRT group of a significant incident affecting your services without delay, and at latest within 24 hours of detecting it, instead of waiting for the full notification (Article 30, paragraph 2). without delayWithout delay, inform the recipients of your services of a significant incident likely to adversely affect them, and communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response. Status since 19 Jun 2025Read from the law library 15 September 2026
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification (Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., § 24 a § 5 ods. 5) 24 hoursReport without undue delay, and no later than 24 hours after becoming aware of it, an early warning of a significant cyber security incident, stating in particular whether it may have been caused by unlawful conduct or may have a cross-border effect. 72 hoursNo later than 72 hours after becoming aware of it, report a notification updating and completing the early warning, in particular an initial assessment of the incident's severity and impact. 24 hoursIf you are also a trust service provider, report a significant cyber security incident, with its effect on your trust services, without undue delay and no later than 24 hours after discovering it, in place of the later notification (Section 24(3)(b)). 1 monthNo later than one month after the 72-hour notification, report a final report describing the incident, its severity and impact, the threat type or probable root cause, the mitigating measures taken and under way, and any cross-border impact. 30 days30 daysWhere an incident with cross-border impact is still ongoing when the final report is due, report an updated final report within 30 days of restoring normal network and system operation; where any significant incident is still ongoing when you submit the final report, report further information and an updated final report within 30 days of its resolution. Status since 1 Jan 2025Read from the law library 15 September 2026

United Kingdom Show the 3 provisionsHide the 3 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
United Kingdom	Duties of Public Electronic Communications Providers to Inform OFCOM and Users of Security Compromises (Communications Act 2003, c. 21, ss. 105J and 105K) as soon as reasonably practicableInform OFCOM as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service, and of any security compromise that puts a person in a position to bring about a further security compromise with such an effect (section 105K(1)). Status since 1 Oct 2022Read from the law library 26 October 2026
United Kingdom	Notification of Incidents by Operators of Essential Services (The Network and Information Systems Regulations 2018, SI 2018/506, reg. 11) 72 hoursGive the notification without undue delay and in any event no later than 72 hours after you are aware that the incident has occurred, in the form and manner the competent authority determines (regulation 11(3)(b)). without undue delayWhere you rely on a relevant digital service provider to provide the essential service, notify your competent authority without undue delay of any significant impact on the continuity of the service caused by an incident affecting that provider (regulation 12(9)). Status since 10 May 2018Read from the law library 26 October 2026
United Kingdom	Notification of Incidents by Relevant Digital Service Providers (The Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(3) to (7)) 72 hoursMake the notification without undue delay and in any event no later than 72 hours after you are first aware that the incident has occurred (regulation 12(6)(a)). Status since 10 May 2018Read from the law library 26 October 2026

United States, federal Show the 10 provisionsHide the 10 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
United States	CFTC system safeguards: prompt notice to Commission staff of cyber security incidents and targeted threats (CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e)) promptlyIf your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan. promptlyIf your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan. promptlyIf your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan. Status since 19 Sep 2016Read from the law library 27 October 2026
United States	Coast Guard Cybersecurity in the Marine Transportation System: reportable cyber incidents (Coast Guard reportable cyber incident reporting, 33 CFR 101.620(b)(7) and 101.615) immediatelyEvidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives. Status since 16 Jul 2025Read from the law library 27 October 2026
United States	Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers (12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC)) 36 hoursIf your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred. A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock. as soon as possibleIf your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more. This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within. Status since 1 May 2022Read from the law library 20 September 2026
United States	Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (6 U.S.C. 681-681g (CIRCIA)) 72 hoursOnce the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred. 24 hoursOnce the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident. promptlyOnce the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes. Status from a date not yet setRead from the law library 20 September 2026
United States	NCUA Cyber Incident Notification Requirements for Federally Insured Credit Unions (NCUA Cyber Incident Notification Requirements, 12 CFR 748.1(c)) 72 hoursIf your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident. 72 hoursWhere the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner. Status since 1 Sep 2023Read from the law library 27 October 2026
United States	NRC cyber security event notifications by nuclear power plant licensees (NRC cyber security event notifications, 10 CFR 73.77) 1 hour1 hourNotify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions. Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii). 4 hoursNotify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification. 8 hoursNotify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope. 24 hoursUse the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery. Status since 2 May 2016Read from the law library 5 November 2026
United States	SEC Cybersecurity Risk Management, Governance, and Incident Disclosure (Regulation S-K Item 106; Form 8-K Item 1.05) (17 CFR 229.106; 17 CFR 249.308 (Form 8-K Item 1.05)) 4 business daysIf your organization is an SEC reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination. 4 business daysIf the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available. Status since 18 Dec 2023Read from the law library 18 September 2026
United States	SEC Regulation S-P: service provider oversight and 72-hour breach notice to the covered institution (SEC Regulation S-P service provider oversight and notice, 17 CFR 248.30(a)(5)) 72 hoursMake those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains. Status in forceRead from the law library 27 October 2026
United States	SEC Regulation SCI: notification of SCI events to the Commission and to members (SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c)) immediatelyUpon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately. 24 hoursWithin 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take. 30 days5 business days30 days5 business daysIf the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure. Status since 3 Nov 2015Read from the law library 27 October 2026
United States	Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012) (48 CFR 252.204-7012) 72 hoursRapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report. Status since 26 Aug 2015Read from the law library 20 September 2026

United States, states Show the 65 provisionsHide the 65 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Alaska	Insurance Data Security, investigation and notification of a cybersecurity event (Alaska Stat. secs. 21.23.270 and 21.23.280 (Insurance Data Security)) 3 business daysNotify the director as soon as possible and not later than three business days after you determine that a cybersecurity event has occurred, unless a federal law enforcement official instructs you not to distribute information about it, in the form and format the director prescribes, with the date of the event, how nonpublic information was exposed, how the event was discovered, the number of Alaska consumers affected, the results of your internal review, your remediation efforts, your privacy policy and a contact person, among the other items listed in the section. 3 business daysIf the event is in an information system a third-party service provider maintains, count your three business days from the day after the provider notifies you or the day after you have actual knowledge of the event, whichever is earlier, unless the provider notifies the director itself. 3 business daysIf you are an assuming insurer without a direct contractual relationship with an affected consumer, notify your affected ceding insurers and the insurance supervisory official of your state of domicile not later than three business days after you determine that a cybersecurity event has occurred, or after your third-party service provider notifies you of one. as soon as possibleIf you are an insurer, notify each independent insurance producer of record of an affected consumer as soon as possible, in the form and format the director prescribes, where the consumer accessed your services through that producer and you have the current producer of record information. Status since 1 Jan 2025Read from the law library 27 October 2026
Arkansas	Public entity security incident report to the Legislative Auditor (Public entity security incident report, Ark. Code Ann. section 10-4-429, Act 260 of 2021) 5 business daysWhen you experience a security incident (any compromise of the security, confidentiality, or integrity of an information system you or a contractual provider maintain, or of your other computer-related services, caused by unauthorized access, destruction, or acquisition of data), give the Legislative Auditor a written initial report of the known facts within five business days after learning of it. Status in forceRead from the law library 27 October 2026
Arizona	Security incident reporting by state budget units and their contractors to the statewide information security and privacy office (A.R.S. sec. 41-4282) immediatelyIdentify and report each security incident to the statewide information security and privacy office in the Arizona department of homeland security immediately on discovery, and deploy mitigation strategies as directed. Status since 24 Sep 2022Read from the law library 27 October 2026
Connecticut	Requirements for state contractors who receive confidential information, breach notice and breach report (Conn. Gen. Stat. sec. 4e-70(b)(6), (b)(8), (e) and (f)) as soon as reasonably feasibleWhere notice is delayed at the state contracting agency's sole discretion, or because a law enforcement or intelligence agency tells you that notice would impede a criminal investigation or jeopardize homeland or national security, give notification to the state contracting agency as soon as reasonably feasible. Status since 1 Jul 2015Read from the law library 27 October 2026
Florida	Local Government Cybersecurity Act, cybersecurity incident and ransomware reporting (Local Government Cybersecurity Act, § 282.3185(5), (6)) 48 hours12 hoursReport every ransomware incident, and every cybersecurity incident you determine to be of severity level 3, 4 or 5, to the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement and the sheriff who has jurisdiction over the local government, as soon as possible and no later than 48 hours after discovery of a cybersecurity incident or 12 hours after discovery of a ransomware incident. 1 weekSubmit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident. Status since 1 Jul 2022Read from the law library 27 October 2026
Florida	State Cybersecurity Act, state agency cybersecurity incident and ransomware reporting (State Cybersecurity Act, § 282.318(3)(c)9., (4)(b), (j), (k)) 48 hours12 hoursReport every ransomware incident, and every cybersecurity incident you determine to be of severity level 3, 4 or 5, to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident or 12 hours after discovery of a ransomware incident. as soon as possibleReport a cybersecurity incident you determine to be of severity level 1 or 2 to the same two bodies as soon as possible. immediatelyHave the agency cybersecurity response team immediately report all confirmed or suspected incidents to the state chief information security officer or a designee. 1 weekSubmit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident. Status in forceRead from the law library 27 October 2026
Georgia	Georgia Cyber Attack Reporting by Agencies (Cyber Attack Reporting by Agencies, O.C.G.A. s. 38-3-22.2(b)) 2 hoursIf the incident is one you must report, or choose to report, to the United States government or any of its agencies, you satisfy the reporting duty by giving the director substantially the same information within two hours of making that federal report (O.C.G.A. 38-3-22.2(b)(2)). Status since 25 Mar 2021Read from the law library 27 October 2026
Georgia	Georgia Cyber Attack Reporting by Utilities (Cyber Attack Reporting by Utilities, O.C.G.A. s. 38-3-22.2(c)) 2 hoursWithin two hours of making that federal report, provide substantially the same information to the director or the director's designee (O.C.G.A. 38-3-22.2(c)). Status since 25 Mar 2021Read from the law library 27 October 2026
Hawaii	Insurance Data Security Law, cybersecurity event investigation and notice to the commissioner (Insurance Cybersecurity Event Notice, Haw. Rev. Stat. Secs. 431:3B-301 to 431:3B-306) 3 business daysNotify the commissioner as promptly as possible, and in no event later than three business days after you determine that a cybersecurity event impacting 250 or more consumers has occurred, when you are an insurer domiciled in Hawaii or an independent insurance producer whose home state is Hawaii (HRS 431:3B-302(a)(1)). 3 business daysIf you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days after you determine that a cybersecurity event has occurred (HRS 431:3B-305(a)). as soon as practicableIf you are an insurer and a consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers as soon as practicable as the commissioner directs (HRS 431:3B-306(a)). Status since 1 Jul 2021Read from the law library 27 October 2026
Iowa	Sanitary sewage utilities, notice to the Utilities Commission of an incident including a cyberattack (Iowa Utilities Commission Rule 199-21.16, incident reports regarding sanitary sewage disposal service) immediatelyNotify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer, and give the utility's name, the name and telephone number of the person making the report and of a contact person who knows about the incident, the location and time of the incident, the number of deaths or personal injuries and their extent, the number of services interrupted, and a summary of what is known about the likely cause and the estimated extent of damage. Status since 26 Feb 2025Read from the law library 27 October 2026
Iowa	Storm water drainage utilities, notice to the Utilities Commission of an incident including a cyberattack (Iowa Utilities Commission Rule 199-21.20, incident reports regarding storm water drainage service) immediatelyNotify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer, and give the utility's name, the name and telephone number of the person making the report and of a contact person who knows about the incident, the location and time of the incident, the number of deaths or personal injuries and their extent, the number of services interrupted, and a summary of what is known about the likely cause and the estimated extent of damage. Status since 26 Feb 2025Read from the law library 27 October 2026
Iowa	Water utilities, notice to the Utilities Commission of an incident including a cyberattack (Iowa Utilities Commission Rule 199-21.9, incident reports regarding water service) immediatelyNotify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer, and give the utility's name, the name and telephone number of the person making the report and of a contact person who knows about the incident, the location and time of the incident, the number of deaths or personal injuries and their extent, the number of services interrupted, and a summary of what is known about the likely cause and the estimated extent of damage. Status since 26 Feb 2025Read from the law library 27 October 2026
Illinois	Insurance Data Security Law, investigation and notification of a cybersecurity event (Insurance Data Security Law, 215 ILCS 215/15 and 215/20) 3 business daysNotify the Director of Insurance as promptly as possible, and no later than 3 business days after you determine that a cybersecurity event has occurred, when Illinois is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming any consumer residing in Illinois or any material part of your normal operations. 3 business daysNotify the Director within the same 3 business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Illinois and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law or has a reasonable likelihood of that harm. 3 business daysTreat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Director the notice; as an assuming insurer, notify your affected ceding insurers and the Director of your state of domicile within 3 business days. Status since 1 Jan 2024Read from the law library 27 October 2026
Indiana	Public water and wastewater cybersecurity: incident reporting to the Office of Technology (Ind. Code sec. 13-18-16.5-1(b)(4)) 24 hours2 business daysWhen an actual or reasonably suspected cybersecurity breach occurs, report the cybersecurity incident to the Office of Technology not later than 24 hours after discovery if it impacts the operations of the entity, or not later than two business days after discovery if it does not, in a format prescribed by the chief information officer of the Office of Technology. Status since 1 Jul 2025Read from the law library 27 October 2026
Indiana	State agency and political subdivision cybersecurity incident reporting to the Office of Technology (Ind. Code sec. 4-13.1-2-9) 2 business daysReport any cybersecurity incident to the Office of Technology, using your best professional judgment, without unreasonable delay and not later than two business days after discovery, in a format prescribed by the chief information officer. Status since 1 Jul 2021Read from the law library 27 October 2026
Kansas	Kansas Cybersecurity Act, notification of a significant cybersecurity incident by a public entity or government contractor (K.S.A. 75-7244) 12 hoursA public entity that has a significant cybersecurity incident must notify the Kansas information security office within 12 hours after discovery. 72 hours12 hoursA government contractor with a significant cybersecurity incident that involves the confidentiality, integrity or availability of personal information or confidential information provided by the state, or of networks or information systems operated by or on behalf of the state, must notify the Kansas information security office within 72 hours after it reasonably believes the incident occurred, or within 12 hours after a determination during the investigation that such information, networks or systems were directly impacted. Status in forceRead from the law library 27 October 2026
Kentucky	Notification of a personal information security breach by public agencies to state officials (Public agency security breach notice to state officials, KRS 61.933(1)) 72 hoursAs soon as possible, and within seventy-two hours of determining or being notified of a security breach relating to personal information you collect, maintain, or store, or that a nonaffiliated third party holds on your behalf, notify in writing, on the form developed by the Commonwealth Office of Technology, the commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General. 48 hoursIf the investigation finds that a security breach occurred and that misuse of personal information has occurred or is reasonably likely to occur, notify in writing all of those officers and the commissioner of the Department for Libraries and Archives within forty-eight hours of completing the investigation, unless a law enforcement delay applies. Status since 1 Jan 2015Read from the law library 27 October 2026
Louisiana	Clerk of court, notification of cyber incidents to the secretary of state (La. R.S. 18:429) 24 hoursNotify the secretary of state, or the secretary's designee, by telephone, electronic mail or facsimile within twenty-four hours following the discovery of a cyber incident that impacts the clerk of court's office related to any computer system connected to or maintained by the secretary of state. Status since 1 Aug 2020Read from the law library 27 October 2026
Maryland	Maryland public service company duty to report a cybersecurity incident to the State Security Operations Center (Md. Code Ann., Pub. Util. section 5-306(d) (Critical Infrastructure Cybersecurity Act of 2023)) 24 hoursMake the report as soon as practicable, but not later than 24 hours after confirmation of a detected cybersecurity incident; you may make a preliminary report while you investigate whether an event is reportable (Department of Information Technology reporting requirements for public utilities). Status since 1 Jul 2023Read from the law library 27 October 2026
Maine	Maine Insurance Data Security Act, notice of a cybersecurity event to the superintendent (Maine Insurance Data Security Act notification of a cybersecurity event, 24-A M.R.S. § 2266) 3 business daysNotify the superintendent as promptly as possible and in no event later than 3 business days from a determination that a cybersecurity event has occurred, if Maine is your state of domicile as an insurance carrier or your home state as an insurance producer. 3 business daysAlso notify the superintendent within 3 business days of that determination if you reasonably believe the nonpublic information involved concerns 250 or more consumers residing in Maine and the event requires notice to a government body, self-regulatory organization or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in Maine or a material part of your normal operation. 3 business daysIf you are an assuming insurer, notify your affected ceding insurers and the superintendent of your state of domicile within 3 business days of determining that a cybersecurity event involving nonpublic information you use or hold has occurred, or of receiving notice from your third-party service provider that one has occurred. Status since 1 Jan 2022Read from the law library 27 October 2026
Michigan	Michigan Insurance Data Security Act, cybersecurity event investigation and notice to the director (Insurance Cybersecurity Event Notice, MCL 500.557 and 500.559) 10 business daysNotify the director as promptly as possible, and not later than 10 business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Michigan is your state of domicile (insurer) or home state (insurance producer) and the event has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(a)). 10 business daysGive the same notice within the same 10 business days when you reasonably believe the nonpublic information involved is of 250 or more Michigan consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(b)). 10 business daysIf you are an assuming insurer, notify your affected ceding insurers and the director of your state of domicile within 10 business days after determining that a cybersecurity event has occurred (section 500.559(5)). Status since 20 Jan 2021Read from the law library 27 October 2026
Michigan	Michigan Public Service Commission Technical Standards for Electric Service, security reporting, oral report of a cybersecurity incident (Electric Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.3205(2)) as soon as reasonably practicableOrally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center as soon as reasonably practicable and before public notification (R 460.3205(2)). Status since 9 Jan 2019Read from the law library 27 October 2026
Michigan	Michigan Public Service Commission Technical Standards for Gas Service, security reporting, oral report of a cybersecurity incident (Gas Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.2324(2)) as soon as reasonably practicableOrally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center as soon as reasonably practicable and prior to any public notification (R 460.2324(2)). Status since 3 Sep 2020Read from the law library 27 October 2026
Minnesota	Minnesota Insurance Data Security Act, notification of a cybersecurity event to the commissioner (Minn. Stat. section 60A.9853 (Minnesota Insurance Data Security Act)) 5 business daysNotify the commissioner of commerce or commissioner of health, whichever regulates you, without unreasonable delay and no later than five business days after you determine that a cybersecurity event has occurred, when Minnesota is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a Minnesota consumer or part of your normal operations, or when you reasonably believe the nonpublic information of 250 or more Minnesota consumers is involved and notice is owed to a government or supervisory body or the event has a reasonable likelihood of that harm (60A.9853, subd. 1). 3 business daysIf you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (60A.9853, subd. 5). Status since 1 Aug 2021Read from the law library 27 October 2026
Minnesota	Minnesota cybersecurity incident reporting by public agencies and government contractors (Minn. Stat. section 16E.36 (Laws 2024, chapter 123, article 17, section 24)) 72 hoursIf you are a public agency, report a cybersecurity incident that impacts you to the commissioner within 72 hours of when you reasonably identify or believe that the incident has occurred, beginning December 1, 2024. 72 hoursIf you are a government contractor or vendor that provides goods or services to a public agency, report a cybersecurity incident to that public agency within 72 hours of when you reasonably identify or believe that it has occurred, if the incident impacts the agency. Status since 1 Dec 2024Read from the law library 27 October 2026
Missouri	Insurance Data Security Act: notice of a cybersecurity event to the director (Insurance Data Security Act, Mo. Rev. Stat. sec. 375.1410) 4 business daysNotify the director as promptly as practicable, and in no event later than four business days, from a determination that a cybersecurity event involving nonpublic information in your possession has occurred, when Missouri is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Missouri or a material part of your normal operations, or when you reasonably believe the information involved is of 250 or more Missouri consumers and notice must be given to a government body, self-regulatory agency, or other supervisory body under state or federal law, or the event has a reasonable likelihood of that harm. 3 business daysAs an assuming insurer, notify your affected ceding insurers and the commissioner or director of insurance of your state of domicile within three business days of determining that a cybersecurity event has occurred. Status since 1 Jan 2026Read from the law library 27 October 2026
Mississippi	Data Security for Money Transmitters Act, notice of a notification event to the Commissioner (Data Security for Money Transmitters Act, section 5, House Bill 1596 (2026)) 72 hoursNotify the Commissioner of Banking and Consumer Finance as soon as possible, and no later than 72 hours after discovery, of a notification event (the acquisition of unencrypted customer information without the authorization of the affected individual) that involves the information of any consumers in Mississippi, in the format the Commissioner specifies. Status since 1 Jul 2026Read from the law library 27 October 2026
Mississippi	Insurance Data Security Law, investigation and notification of a cybersecurity event (Insurance Data Security Law, sections 5 and 6, Senate Bill 2831 (2019)) 3 business daysNotify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Mississippi is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of your normal operations. 3 business daysNotify the Commissioner within the same three business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations. 3 business daysAs an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred. Status since 1 Jul 2019Read from the law library 27 October 2026
Montana	State agencies, immediate notice of a security incident to the chief information security officer (Mont. Code Ann. § 2-6-1504) without unreasonable delayOn discovery or notification of a security incident, provide immediate notification without unreasonable delay to the chief information security officer at the department of administration. Status since 1 Oct 2023Read from the law library 27 October 2026
North Dakota	Cybersecurity Incident Reporting Requirements, disclosure of a cybersecurity incident to the Information Technology Department (N.D. Cent. Code ch. 54-59.1) without unreasonable delayDisclose to the information technology department an identified or suspected cybersecurity incident that affects the confidentiality, integrity, or availability of information systems, data, or services, in the most expedient time possible and without unreasonable delay. Status in forceRead from the law library 27 October 2026
North Dakota	Insurance Data Security Law, investigation and notification of a cybersecurity event (N.D. Cent. Code §§ 26.1-02.2-04, 26.1-02.2-05) 3 business daysNotify the commissioner as promptly as possible, and no later than three business days from your determination that a cybersecurity event has occurred, where the event triggers notification to a consumer residing in North Dakota under chapter 51-30 or has a reasonable likelihood of harming any material part of your normal operations. 3 business daysNotify the commissioner within the same three business days where you reasonably believe the nonpublic information involved is of two hundred fifty or more consumers residing in North Dakota and the event requires notice to any government body, self-regulatory agency, or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in North Dakota or any part of your normal operations. 3 business days3 business daysIf you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of making the determination that a cybersecurity event has occurred, or within three business days of receiving notice from your third-party service provider. Status in forceRead from the law library 27 October 2026
New Hampshire	Political subdivision cybersecurity incident report to the New Hampshire cyber integration center (Political subdivision cybersecurity incident reporting, RSA 31:103-b) immediatelyIf you know of or suspect a cybersecurity incident within the political subdivision's information systems, or within any vendor acting as an agent of the political subdivision, report it immediately upon discovery to the New Hampshire cyber integration center of the department of information technology. Status since 16 Aug 2022Read from the law library 27 October 2026
New Jersey	Board of Public Utilities Order on Utility Cyber Security Program Requirements, incident reporting (Utility Cyber Security Incident Reporting, N.J. Board of Public Utilities Docket No. A016030196 Order (March 18, 2016), requirement 3) 6 hoursReport to the Board's Reliability and Security Division staff, through the New Jersey Cybersecurity and Communications Integration Cell, within 6 hours of detection, any person accessing an industrial control system without authorization or exceeding authorized access, any unauthorized programs, information, code or commands discovered on an industrial control system, and any extortion of money or other thing of value by threatening damage to an industrial control system. Status since 28 Mar 2016Read from the law library 27 October 2026
New Jersey	Cybersecurity incident reporting by public agencies and government contractors (N.J. Stat. Ann. 52:17B-193.2 to 52:17B-193.4 (P.L. 2023, c.19)) 72 hoursReport each cybersecurity incident to the New Jersey Office of Homeland Security and Preparedness within 72 hours of when you reasonably believe that a cybersecurity incident has occurred. Status since 13 Mar 2023Read from the law library 27 October 2026
New Jersey	Water Quality Accountability Act, water purveyor cybersecurity incident report to the NJCCIC (N.J. Stat. Ann. 58:31-4.2 (P.L. 2021, c.262, section 4)) promptlyReport to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of the incident and in accordance with all applicable laws, rules and regulations, any cybersecurity incident that compromises the confidentiality, integrity, availability or privacy of your utility billing, communications, data management or business information systems or the information on them. Status since 6 Feb 2022Read from the law library 27 October 2026
New Mexico	Cybersecurity incident reporting order for agencies and political subdivisions (Cybersecurity Incident Reporting, Order No. 2025-01 of the New Mexico Chief Information Security Officer, paragraphs 2 to 4 and 6 to 7) 24 hoursWithin 24 hours of discovering a cybersecurity incident involving the public entity or one of its vendors, notify and consult with the Office of Cybersecurity (Order paragraph 2). 10 days10 daysWithin 10 days of receiving the Order, designate a point of contact in the form and manner the Office of Cybersecurity specifies, and report any change of that contact within 10 days (Order paragraph 7). Status since 30 Jun 2025Read from the law library 27 October 2026
Nevada	Governor's Technology Office, reporting of suspected cybersecurity incidents by a using agency (NRS 242.181(2) and (3)) 1 business day24 hoursReport any suspected data breach, distributed denial of service incident, ransomware incident, incident that disrupts the delivery of essential services for more than 1 business day or directly affects life or property, or security-related noncompliance with the Office's regulations, standards, practices, policies and conventions, to the Office of Information Security and Cyber Defense and the Security Operations Center within 24 hours after discovery of the suspected incident. Status in forceRead from the law library 27 October 2026
New York	Cybersecurity incident reporting by municipal corporations and public authorities (N.Y. Gen. Mun. Law art. 19-C, secs. 995-a to 995-c (L. 2025, ch. 177)) 72 hoursReport each cybersecurity incident, and any demand for a ransom payment, to the Commissioner of the Division of Homeland Security and Emergency Services in the form and method the Commissioner prescribes, no later than 72 hours after you reasonably believe the incident has occurred, stating whether you request or decline the Division's advice or technical assistance. 24 hours30 daysIf a ransom payment is made in connection with a cybersecurity incident, give the Commissioner notice of the payment within 24 hours and, within 30 days, a written description of why payment was necessary, the amount, the means of payment, the alternatives to payment you considered, the diligence you performed to find alternatives and the diligence you performed to ensure compliance with state and federal rules, including those of the Treasury Department's Office of Foreign Assets Control. Status since 26 Jul 2025Read from the law library 27 October 2026
New York	Hospital Cybersecurity Requirements, notice of a cybersecurity incident to the Department of Health (10 NYCRR 405.46(n)) 72 hoursNotify the Department of Health as promptly as possible, but no later than 72 hours after determining that a cybersecurity incident has occurred, in the manner the Department prescribes; this notice does not replace other notices required by state or federal law. Status since 2 Oct 2024Read from the law library 27 October 2026
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent (23 NYCRR 500.17) 72 hoursNotify the Superintendent electronically, in the form set forth on the Department's website, as promptly as possible but no later than 72 hours after you determine that a Cybersecurity Incident has occurred at your organization, an affiliate, or a third-party service provider: an event that requires notice to a government or supervisory body, that has a reasonable likelihood of materially harming a material part of your normal operations, or that results in the deployment of ransomware within a material part of your information systems. promptlyPromptly provide the Superintendent any information requested about a reported incident, and continue updating the Superintendent with material changes or new information previously unavailable; the regulation states no separate numbered clock for either duty. 24 hours30 daysWhere you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules. Status in forceRead from the law library 20 September 2026
New York	Public Service Commission Information Technology Cybersecurity Requirements, notices to the Department (16 NYCRR 1200.21) 72 hoursNotify the Director of the Department of Public Service's Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after you reasonably believe a cybersecurity incident has occurred or is occurring that affects your information technology or information, or that of an affiliate or a third-party provider; no transitional period applies to this duty. Status since 1 Jun 2026Read from the law library 27 October 2026
Ohio	Ohio Insurance Data Security Law, cybersecurity event investigation and notice to the superintendent (Insurer Cybersecurity Event Notice, Ohio Rev. Code ss. 3965.03 and 3965.04) 3 business daysNotify the superintendent of insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Ohio is your state of domicile (insurer) or home state (independent insurance agent) and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations (section 3965.04(A)(1)). 3 business daysGive the same notice within the same three business days when you reasonably believe the nonpublic information involved relates to 250 or more Ohio consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming an Ohio consumer or a material part of your normal operations (section 3965.04(A)(2)). 3 business daysIf you are an assuming insurer, notify your affected ceding insurers and the insurance commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (section 3965.04(E)(1)). Status since 20 Mar 2019Read from the law library 27 October 2026
Ohio	Political Subdivision Cybersecurity, incident notice to homeland security and the auditor of state (Political Subdivision Cybersecurity Incident Report, Ohio Rev. Code s. 9.64(D)) 7 daysAfter each cybersecurity incident or ransomware incident, have the legislative authority notify the executive director of the division of homeland security within the department of public safety, in the manner the executive director prescribes, as soon as possible and no later than seven days after the political subdivision discovers the incident (section 9.64(D)(1)). 30 daysAlso notify the auditor of state, in the manner the auditor of state prescribes, as soon as possible and no later than thirty days after the political subdivision discovers the incident (section 9.64(D)(2)). Status since 30 Sep 2025Read from the law library 27 October 2026
Oklahoma	Electric utilities: immediate report of a cybersecurity or infrastructure security event to the Public Utility Division (OAC 165:35-33-7(c), electric utility cybersecurity event reporting) immediatelyReport cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director and his or her designee. Status in forceRead from the law library 27 October 2026
Oklahoma	Gas utilities: immediate report of a cybersecurity or infrastructure security event to the Public Utility Division (OAC 165:45-21-7(c), gas utility cybersecurity event reporting) immediatelyReport cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director or designee. Status in forceRead from the law library 27 October 2026
Oklahoma	Water utilities: immediate report of a cybersecurity or infrastructure security event to the Public Utility Division (OAC 165:65-9-2(4), water utility cybersecurity event reporting) immediatelyReport cybersecurity or infrastructure security events that affect customers immediately to the Public Utility Division Director or designee. Status in forceRead from the law library 27 October 2026
Oregon	State agencies, notice to the Legislative Fiscal Office of an information security incident (ORS 276A.306(2) and (3)) promptlyPromptly notify the Legislative Fiscal Office of an information security incident and describe the actions the agency has taken or must reasonably take to prevent, mitigate or recover from damage to, unauthorized access to, unauthorized modifications or deletions of or other impairments of the integrity of the agency's information system or information resources. Status since 1 Jul 2016Read from the law library 27 October 2026
Puerto Rico	Cybersecurity Standards for the Insurance Industry, investigation of a cybersecurity incident and notice to the Commissioner within 72 hours (Rule No. 108 of the Insurance Code Regulations, Sections 9 and 10, Cybersecurity Standards for the Insurance Industry) as soon as possibleIf you learn that a cybersecurity incident has occurred or may have occurred, conduct an investigation as soon as possible and prepare a written report, and at a minimum determine whether an incident occurred, assess its nature and scope, identify the nonpublic information that may have been affected, and perform or oversee reasonable measures to restore the security of the affected information systems; if the incident is in a system maintained by a service contractor, complete those steps or confirm and document that the contractor completed them. 72 hoursNotify the Commissioner as promptly as possible, within 72 hours after it has been determined that a cybersecurity incident has occurred, when you reasonably believe that the nonpublic information involved impacts 250 or more consumers residing in Puerto Rico and the incident impacts you in a manner that requires notice to a government agency, corporation or instrumentality, regulatory agency or supervisory entity under a state or federal law, or has a reasonable probability of causing material harm to consumers residing in Puerto Rico or to a material aspect of your normal operations. 72 hours72 hoursIf you act as a reinsurer and the incident involves nonpublic information you use or hold and you have no direct contractual relationship with the affected consumers, notify the affected ceding insurers and the Commissioner of your state of domicile within 72 hours of determining that an incident occurred, or, for an incident at your service contractor, within 72 hours of receiving the contractor's notice. as soon as possibleIf you are an insurer or health service organization and your services reached the consumer through a producer or intermediary, notify the producer or intermediary of record of all affected consumers as soon as possible, unless you have no current information about the producer or intermediary for a consumer. Status in forceRead from the law library 27 October 2026
Puerto Rico	Government Cybersecurity Act, incident reporting to the Puerto Rico Innovation and Technology Service (Ley Núm. 40 de 18 de enero de 2024 (Ley de Ciberseguridad del Gobierno de Puerto Rico), Arts. 7(10), 7(11) and 8) 48 hoursAs an information and communications technology contracted service provider, share information and notify PRITS and the contracting Agency within 48 hours (no más de cuarenta y ocho horas) of discovering a cybersecurity incident, or a potential incident, that may put at risk the confidential data, software products, firmware or services of the Government or of any natural or legal person. every monthAs an external provider under a cybersecurity services contract, file monthly reports with PRITS on the cybersecurity status of the information systems and any sensitive asset managed on behalf of the Agency, covering the threats detected, threat actors and vulnerabilities, the immediate response and remediation actions, the total number of information security incidents reported to PRITS through the cybersecurity incident reporting platform, and the assessment of the cybersecurity status. Status since 18 Jan 2024Read from the law library 27 October 2026
Rhode Island	Licensed nonbank financial institutions, notification of a security event (R.I. Gen. Laws sec. 19-14-36) 3 business daysNotify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when you must give notice of the event to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations. Status since 2 Jul 2025Read from the law library 27 October 2026
Rhode Island	Municipal and state agencies, notification of a cybersecurity incident to the state police (R.I. Gen. Laws sec. 11-49.3-7) 24 hoursNotify the Rhode Island state police upon detection of the cybersecurity incident, within twenty-four hours. Status since 27 Jun 2023Read from the law library 27 October 2026
South Carolina	Insurance Data Security Act, investigation and notice of a cybersecurity event to the director (Insurance Data Security Act cybersecurity event notice, S.C. Code Ann. secs. 38-99-30 and 38-99-40) 72 hoursNotify the director of the Department of Insurance no later than seventy-two hours after you determine that a cybersecurity event has occurred, when South Carolina is your state of domicile (insurer) or your home state (producer). 72 hoursGive the same notice within seventy-two hours when you reasonably believe the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of your normal operations. 72 hoursAs an assuming insurer that does not have a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the director of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred; as an insurer whose consumers accessed your services through an independent producer, notify the producers of record of affected consumers as soon as practicable as the director directs. Status since 1 Jan 2019Read from the law library 27 October 2026
Tennessee	State agency notice to the Comptroller of the Treasury of unauthorized data acquisition or a security system breach (Tenn. Code Ann. sec. 8-4-119) 5 business daysThe Comptroller states that the report should be made within five working days after confirming or suspecting the acquisition or breach. Status since 27 Mar 2015Read from the law library 27 October 2026
Tennessee	State entities and ransomware: no ransom payment and immediate notice to the Tennessee Bureau of Investigation (Public Chapter 534 (2024), Tenn. Code Ann. title 4, chapter 1, part 4 (new section)) immediatelyWhen a state entity experiences a ransom request in connection with a cybersecurity incident, immediately notify and consult with the technology and innovation division of the Tennessee Bureau of Investigation. Status in forceRead from the law library 27 October 2026
Tennessee	Utility cybersecurity incident notification to the Tennessee Public Utility Commission (Tennessee Public Utility Commission Rule 15 April 1220-.06, adopted under Tenn. Code Ann. sec. 65-4-127) 72 hoursElectronically notify the Commission's Executive Director of any cybersecurity incident that results in interruption of service within 72 hours after discovery and confirmation. 24 hoursUnless law enforcement prohibits or recommends against notice to avoid compromising an investigation, notify on that clock; where it does, notify within 24 hours after the restriction is lifted by law enforcement. Status in forceRead from the law library 27 October 2026
Texas	Texas Cyber Command, cybersecurity incident notification by a state agency or local government (Tex. Gov't Code sec. 2063.302) 48 hoursNotify the Texas Cyber Command, including the chief, not later than 48 hours after the discovery of the cybersecurity incident, or notify the secretary of state if the incident involves election data, and comply with the command's rules on reporting cybersecurity incidents. Status since 1 Sep 2025Read from the law library 27 October 2026
Texas	Texas money services business regulation, notice of a cybersecurity incident to the banking commissioner (7 Tex. Admin. Code sec. 33.30) 15 daysNotify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice or report to another state or federal regulatory or law enforcement agency or a self-regulatory body, require a data breach notification to customers under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect transactions for customers, report transactions accurately, or conduct your business. Status since 2 Jan 2020Read from the law library 27 October 2026
Texas	Texas state bank regulation, notice of a computer-security incident to the banking commissioner (7 Tex. Admin. Code sec. 3.24) 36 hoursNotify the banking commissioner of a computer-security incident that qualifies as a notification incident under 12 CFR Part 225, Subpart N, or Part 304, Subpart C, and submit the information those regulations require, no later than the time that information is due to your federal banking regulator; the Department of Banking states that this is 36 hours after you determine a notification incident has occurred. Status since 2 Jan 2020Read from the law library 27 October 2026
Texas	Texas trust company regulation, notice of a cybersecurity incident to the banking commissioner (7 Tex. Admin. Code sec. 17.5) 15 daysNotify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice to another state or federal regulator or a self-regulatory body, require a data breach notification to clients or beneficiaries under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect or report transactions or conduct your business. Status since 2 Jan 2020Read from the law library 27 October 2026
Utah	Government Data Privacy Act, notification of a data breach by a governmental entity to the Utah Cyber Center (Utah Code 63A-19-405) 5 daysNotify the Utah Cyber Center, and the attorney general where the breach affects 500 or more individuals, of a data breach, without unreasonable delay and no later than five days from discovery, stating the date and time of the breach, the date of discovery, a short description, how access was gained, who perpetrated it, the mitigation steps taken and any other detail the Cyber Center requests. 5 daysIf that information is not available within five days, provide what is available and supplement the notification as the information becomes available. as soon as practicableFor a data breach affecting fewer than 500 individuals, create an internal incident report as soon as practicable, give it to the Cyber Center on request, and give the Cyber Center an annual report logging all such incidents. Status since 1 May 2024Read from the law library 27 October 2026
Utah	Safe Drinking Water Act, report of a security breach at a community water system (Utah Code 19-4-117(3)) 2 hoursReport a security breach to the Utah Cyber Center no later than two hours after you discover it. A security breach is an incident that threatens the security of the community water system with the potential to impact the quality or quantity of delivered water, and includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network. Status since 6 May 2026Read from the law library 27 October 2026
Virginia	Public bodies: incident reporting to the Virginia Fusion Intelligence Center (Va. Code Ann. § 2.2-5514) 24 hoursReport to the Virginia Fusion Intelligence Center, within 24 hours from when the incident was discovered, all known incidents that threaten the security of the Commonwealth's data or communications or result in exposure of data protected by federal or state laws. 24 hoursReport to the Virginia Fusion Intelligence Center, within 24 hours from when the incident was discovered, other incidents compromising the security of your information technology systems with the potential to cause major disruption to the normal activities of your public body or other public bodies. Status since 1 Jul 2022Read from the law library 27 October 2026
Washington	Major cybersecurity incidents: state agency reporting to the office of cybersecurity (RCW 43.105.470) 24 hoursIn the event of a major cybersecurity incident, as defined in policy established by the office of cybersecurity, report the incident to the office of cybersecurity within 24 hours of discovery. Status since 25 Jul 2021Read from the law library 27 October 2026
Wisconsin	Insurance Data Security Law, investigation and notice of a cybersecurity event to the commissioner (Insurance Data Security Law cybersecurity event notice, Wis. Stat. secs. 601.953 and 601.954(1)) 3 business daysNotify the commissioner of Insurance in electronic form, as promptly as possible and no later than 3 business days after you determine that a cybersecurity event involving nonpublic information has occurred, if you are domiciled in Wisconsin and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations. 3 business daysGive the same notice within the same 3 business days if you reasonably believe the event involves the nonpublic information of at least 250 consumers and either requires notice to a government body, self-regulatory agency, or other supervisory entity under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations. Status in forceRead from the law library 27 October 2026
West Virginia	State agencies, local governments and other public bodies, cyber incident reporting to the Cybersecurity Office (W. Va. Code §§ 5A-6C-2, 5A-6C-3) 10 daysReport a qualified cybersecurity incident to the Cybersecurity Office before any citizen notification, and no later than 10 days after determining that the entity experienced a qualifying cybersecurity incident. Status since 5 Jul 2021Read from the law library 27 October 2026

Asia and the Pacific Show the 37 provisionsHide the 37 provisions

Jurisdiction	Instrument, and the obligation lines that carry a clock
Australia	Prudential Standard CPS 234 Information Security, Notification to APRA (Prudential Standard CPS 234 Information Security (APRA), paras 35 and 36; Banking Act 1959 (Cth), s. 11AG) 72 hoursNotify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers, or that has been notified to other regulators, either in Australia or other jurisdictions (paragraph 35). 10 business daysNotify APRA as soon as possible and, in any case, no later than 10 business days, after becoming aware of a material information security control weakness that you expect you will not be able to remediate in a timely manner (paragraph 36). Status since 1 Jul 2019Read from the law library 26 October 2026
Australia	Security of Critical Infrastructure Act, Notification of Cyber Security Incidents (Security of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5) 12 hoursGive the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing. 84 hoursIf you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)). 72 hoursGive the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)). Status since 8 Jul 2022Read from the law library 26 October 2026
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident (Cyber Security Act, 2026 (Act No. 81 of 2026), s. 9) without delayWithout delay after a cyber incident occurs, inform the National Computer Emergency Response Team the National Cyber Security Agency maintains; the Act names no fixed number of hours or days for this notification. Status since 21 May 2025Read from the law library 18 September 2026
Brunei Darussalam	BDCB Notice on Cyber Intrusion and IT Incident Reporting by Banks (Notice on Early Detection of Cyber Intrusion and Incident Reporting (Notice TRS/N-1/2020/1, Amendment No. 1), paras. 4.1 to 4.7) 1 hourNotify Technology Risk of the Brunei Darussalam Central Bank no later than one hour after the discovery of a Suspected Incident, by email, telephone call or another authorised communication channel (paragraph 4.1). 2 hoursAssess the Suspected Incident and notify the Central Bank no later than two hours after first discovery whether it is a successful cyber intrusion and whether it is a major IT incident (paragraph 4.2). 5 business daysSubmit an IT Incident Report to the Central Bank by email within 5 working days from the notification under paragraph 4.2, or the longer period the Central Bank allows (paragraph 4.5). Status since 1 Jan 2024Read from the law library 26 October 2026
China	Data Security Law, Risk Monitoring and Incident Reporting Duty (Data Security Law of the People's Republic of China, Art. 29) promptlyOn an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness. Status since 1 Sep 2021Read from the law library 12 September 2026
China	National Cybersecurity Incident Reporting Measures (Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued September 11, 2025), Arts. 2, 4, 5, 8, 9, 12, 14) 1 hourWhere the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident. 2 hoursWhere you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident. 4 hoursEvery other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident. promptlyWhere your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly. promptlyWhere an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer. 30 daysWithin 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report. Status since 1 Nov 2025Read from the law library 20 September 2026
China	Network Data Security Management Regulation, product vulnerability and incident reporting (Regulation on Network Data Security Management (State Council Order 790), Arts. 9-11) 24 hoursOn finding a security defect, vulnerability or similar risk in a network product or service you provide, take remedial measures at once, tell users as required and report to the competent department; where national security or the public interest is endangered, also report to the competent department within 24 hours (Article 10). promptlyWhere an incident harms the lawful rights and interests of individuals or organizations, promptly tell those affected the incident, the risk, the harm and the remedial steps taken, by phone, text message, instant message, email or public announcement, unless a law or administrative regulation allows non-notification (Article 11). Status since 1 Jan 2025Read from the law library 26 October 2026
China	Network Product Security Vulnerability Management Provisions, product provider duties (Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security), Arts. 5, 7 and 12) 2 daysReport the vulnerability within 2 days to the cybersecurity threat and vulnerability information sharing platform of the Ministry of Industry and Information Technology, stating the product name, model and version and the vulnerability's technical features, harm and scope (Article 7(2)). promptlyOrganize prompt repair of the vulnerability; where users, including downstream manufacturers, must upgrade software or firmware, promptly tell the users who may be affected the risk and the repair method, and give necessary technical support (Article 7(3)). Status since 1 Sep 2021Read from the law library 26 October 2026
China	People's Bank of China Cybersecurity Incident Reporting Measures, financial institution duties (Measures for the Administration of Cybersecurity Incident Reporting in the Business Areas of the People's Bank of China, Arts. 2, 6, 12 and 14-17) 1 hour24 hoursAfter an incident of the relatively major grade or above, send the People's Bank of China, or its branch at your place of domicile, a brief incident report within 1 hour and an incident report within 24 hours (Articles 14 and 15). every 2 hoursFor a major incident or above, send a progress report at least every 2 hours until handling ends, and report at once when the grade is raised or a new problem is found (Article 16). 10 business days40 business daysWithin 10 working days after handling ends, send a written post-incident investigation summary report; if you cannot, send a preliminary report on time that states a promised date within 40 working days (Article 17). Status since 1 Aug 2025Read from the law library 26 October 2026
Fiji	Reserve Bank of Fiji Prudential Supervision Policy Statement 2, Cybersecurity Incident Reporting (Prudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), para. 17) 24 hoursNotify the Reserve Bank of Fiji within 24 hours after becoming aware of a cybersecurity incident that materially affects or has the potential to materially affect, financially or non-financially, your institution or the interests of depositors, policyholders, fund members, investors or the general public who use your services (para. 17.2). Status since 31 Mar 2023Read from the law library 27 October 2026
Hong Kong	Protection of Critical Infrastructures (Computer Systems) Ordinance, Incident Notification (Cap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance)) 12 hours48 hoursNotify the Commissioner as soon as practicable, and within 12 hours after becoming aware of a computer-system security incident that has disrupted, is disrupting or is likely to disrupt the core function of the critical infrastructure, or within 48 hours in any other case (section 28(1), (2) and Schedule 6). 48 hoursIf you did not notify in the form and way the regulating authority specified, submit a written record of the incident in that form within 48 hours after the notification (section 28(3) and Schedule 6). 14 daysSubmit a written report of the incident in the specified form and way to the Commissioner within 14 days after the date you become aware of it (section 28(4) and Schedule 6). Status since 1 Jan 2026Read from the law library 2 November 2026
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty (Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3)) immediatelyReport the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy. Status since 10 Oct 2019Read from the law library 16 September 2026
Indonesia	OJK Regulation on Information Technology in Commercial Banks, Reporting of IT and Cyber Incidents (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum, arts. 60 and 63) 24 hours5 business daysWhere an IT incident has or may have caused a significant loss or disrupted the smooth running of your operations, send the Financial Services Authority an initial notification within 24 hours after the incident becomes known, and an IT incident report within 5 working days after it becomes known (Article 60(1)). An IT incident is a critical event, misuse or crime in the operation of IT, in the form of a cyber incident or a non-cyber incident (elucidation of Article 60(1)). Status in forceRead from the law library 26 October 2026
Indonesia	Presidential Regulation 82 of 2022, reporting of cyber incidents on vital information infrastructure (Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 13 dan 14) 24 hoursReport each cyber incident on your vital information infrastructure to your sector's incident response team, copied to the national team, no later than 24 hours after it is found, or to the ministry or agency of your sector where no sectoral team has been formed (article 13). Status since 24 May 2022Read from the law library 27 October 2026
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation (Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022)) 6 hoursReport a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website. Status since 27 Jun 2022Read from the law library 12 September 2026
India	RBI Commercial Banks Cybersecurity Directions, Cyber Incident Reporting (Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 181 to 183) 6 hoursReport cyber incidents to the Reserve Bank within six hours of detection on its DAKSH platform (paragraph 182). Status since 31 Jul 2026Read from the law library 26 October 2026
India	Telecom Cyber Security Rules, Reporting of Security Incidents (Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), r. 7) 6 hoursReport a security incident affecting your telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, with relevant details of the affected system including a description of the incident (rule 7(1)(a)). A security incident is an event having real or potential risk on telecom cyber security (rule 2(1)(e)). Status since 21 Nov 2024Read from the law library 26 October 2026
Japan	Important Computers Act, Report of Specified Infringement Events (Act on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025), Art. 5) 30 daysFile a first report promptly after becoming aware of the event, stating what you know at that time, and file a full report within 30 days of the day you became aware of it (Article 4(2) of the order). Status since 1 Oct 2026Read from the law library 26 October 2026
Japan	Telecommunications Business Act, Report of Service Stoppages and Significant Accidents (Telecommunications Business Act (電気通信事業法, Act 86 of 1984), Art. 28) without delayReport to the Minister of Internal Affairs and Communications, without delay and with the reason or cause, any partial suspension of your telecommunications business made under Article 8(2) and any leak of the secrecy of communications or other significant accident the ministerial order names (Article 28(1)). without delayReport to the Minister, without delay and with the reason or cause, any situation the ministerial order names as likely to lead to such an accident (Article 28(2)). Status since 1 Apr 1985Read from the law library 26 October 2026
Kyrgyzstan	Digital Code, digital resilience incident notification (Digital Code, Law No. 178, Art. 63) 72 hoursNotify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice. 48 hoursIf you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it. Status since 6 Feb 2026Read from the law library 18 September 2026
Kyrgyzstan	Law on Cybersecurity, informing of cyber incidents (Law of the Kyrgyz Republic No. 121 (17 July 2024) "On Cybersecurity of the Kyrgyz Republic", Arts. 8(5), 10(2) and 17) immediatelyInform the authorized state body in the cybersecurity sphere of cyber incidents affecting your critical information infrastructure, or the National Bank if it supervises you (Article 10(2)(3)); the Law states no hour count, and your head and the staff responsible for cybersecurity answer for informing immediately (Article 8(5)). immediatelyIf you are a state body, local self-government body or an enterprise, organization or institution with state participation using information infrastructure objects, provide for timely detection of unauthorized access to information and for immediately informing the authorized state body, and pass on the known data on cyber threats and cyberattacks (Article 17). Status in forceRead from the law library 26 October 2026
South Korea	Information and Communications Network Act, Report on Computer Security Incidents (Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024)) immediatelyImmediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated. Status since 10 Jun 2022Read from the law library 12 September 2026
Kazakhstan	Law on Cybersecurity, notice of cybersecurity incidents (Law of the Republic of Kazakhstan No. 418-V (24 November 2015) "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9 January 2026), Arts. 18(1)(3) and 54(2)) immediatelyIf you own or hold digital government infrastructure objects or critically important digital objects, take measures that provide for immediately informing the National Cybersecurity Coordination Centre of a cybersecurity incident that has occurred, followed by digital data on the measures taken to resolve it; an owner of resources that hold state secrets is excepted (Article 54(2)(7)). Status in forceRead from the law library 26 October 2026
Laos	Law on Cyber Security, incident response, incident reporting and annual report (Law on Cyber Security (2025), arts. 30, 31, 40, 43 and 44, incident response and reporting) immediatelyAs a legal person or organization operating in cyber security work in Laos, report a cyber security incident that causes damage to the unit responsible for cyber security immediately after discovering it. Status since 1 Sep 2025Read from the law library 2 November 2026
Sri Lanka	Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks (Central Bank of Sri Lanka Circular No. 02 of 2025 (Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks), paragraphs 2 to 5 and Annexes 01 to 03) 2 hoursReport an IT or cybersecurity incident to the Director, Bank Supervision Department, at techrisk.bsd@cbsl.lk, copying dbsd@cbsl.lk, in the Annex 01 format within 2 hours of detecting it (paragraph 4, Table 01). 14 days14 business daysSend the detailed report in the Annex 02 format, with a root cause analysis and the corrective actions taken, within 14 days of detecting the incident; the Annex 02 guidelines say 14 working days (paragraph 4, Table 01, and Annex 02). Status since 7 May 2025Read from the law library 3 November 2026
Mongolia	Law on Cyber Security, Critical Information Infrastructure Organizations' Duty to Notify Cyber-Attacks and Failures (Law of Mongolia on Cyber Security, adopted 17 December 2021, in force 1 May 2022, Art. 19 (notification duties)) immediatelyNotify the relevant center against cyber-attacks and violations immediately when the normal, uninterrupted operation of your information systems and infrastructure fails because of cyber-attacks and violations (article 19.2.14). immediatelyNotify the relevant center and your users immediately when the normal, uninterrupted operation of your infrastructure fails because of planned inspections and audits, damage, or force majeure events and circumstances affecting networks and systems outside your own infrastructure (article 19.2.15). 1 monthSubmit each cyber security risk assessment report and information security audit report to the relevant center against cyber-attacks and violations within one month of receiving it (article 19.2.10). Status since 1 May 2022Read from the law library 27 October 2026
Papua New Guinea	Cybersecurity Bill 2026, Incident Reporting by CII Operators and Financial Institutions (Cybersecurity Bill 2026 (Papua New Guinea consultation draft), ss. 35 and 41(b)) 24 hoursNotify the Authority within 24 hours of becoming aware of a cybersecurity incident affecting a designated CII facility or system, stating what happened, when it was discovered, which facility or system is affected, its likely impact and the measures taken or proposed to mitigate it (s. 35(1) and (2)). 7 daysProvide a full incident report to the Authority within 7 days of the incident (s. 35(3)). 24 hoursIf you are a financial institution, report a cybersecurity incident affecting your systems to both the Authority and the Bank of Papua New Guinea within 24 hours of detection (s. 41(b)). Status proposedRead from the law library 27 October 2026
Papua New Guinea	Cybersecurity Bill 2026, Mandatory Incident Reporting by Any Entity (Cybersecurity Bill 2026 (Papua New Guinea consultation draft), s. 111) 24 hours72 hoursMake the notification within 24 hours if you are a CII operator or a financial institution, and within 72 hours if you are any other entity (s. 111(1)). Status proposedRead from the law library 27 October 2026
Philippines	Manual of Regulations for Banks, Cyber Incident and Service Disruption Notification to the Bangko Sentral (Manual of Regulations for Banks, Section 148 (Information Technology Risk Management), reporting and notification standards) 2 hoursNotify the appropriate supervising department of the Bangko Sentral, through your Compliance Officer or a designated officer, within two hours from discovery of a reportable major cyber-related incident or of a disruption of financial services and operations (Section 148, reporting and notification standards, item b(1)). 24 hoursSend a follow-up report by e-mail to the same department within twenty-four hours from the time of discovery, covering the nature of the incident, how and when you first detected it, its initial impact, your initial response, and whether the business continuity or crisis management plan was activated (item b(3)). Status in forceRead from the law library 27 October 2026
Singapore	Cybersecurity Act 2018, Report of Cybersecurity Incidents on Provider-Owned Critical Information Infrastructure (Cybersecurity Act 2018 (Act 9 of 2018), s. 14, with the Cybersecurity (Provider-Owned Critical Information Infrastructure) Regulations 2018 (S 519/2018), reg. 5) 2 hours72 hours30 daysFor an incident in respect of the infrastructure, an interconnected system of yours, an interconnected system of a supplier, an incident type the Commissioner has specified, or one that disrupts or degrades delivery of the essential service, submit the first details within 2 hours after becoming aware of it, supplementary details within 72 hours, and a final incident report within 30 days after the supplementary submission (regulation 5(1) and (1A)). Status since 31 Aug 2018Read from the law library 26 October 2026
Singapore	MAS Notice FSM-N05, Report of Relevant Incidents by Banks (Monetary Authority of Singapore Notice FSM-N05 on Technology Risk Management, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 7 and 8) 1 hourNotify the Monetary Authority of Singapore as soon as possible, and not later than 1 hour, after you discover a relevant incident (paragraph 7). 14 daysSubmit a root cause and impact analysis report within 14 days of discovering the relevant incident, or any longer period the Authority allows, covering an executive summary, the root cause, the impact on compliance, operations and customers, and the remedial measures taken (paragraph 8). Status since 10 May 2024Read from the law library 26 October 2026
Thailand	Cybersecurity Act, Reporting of Cyber Threats by Critical Information Infrastructure Organizations (Cybersecurity Act, B.E. 2562 (2019), ss. 57, 58 and 73) without delayIf the examination shows that there is or may be a Cyber Threat, prevent, cope with and mitigate the risks in accordance with your Code of Practice and standard framework, and notify the Office and your Supervising or Regulating Organization without delay (section 58). Status since 28 May 2019Read from the law library 26 October 2026
Taiwan	Cyber Security Incident Reporting, Response and Drills Regulations, Specific Non-Government Agency Clocks (Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法), full-text amendment issued Jan. 5, 2026 (Ministry of Digital Affairs Order Shu-Shou-Zi-Fa-Zi No. 1145000415), Arts. 11 and 13) 1 hourReport a cyber security incident in the manner the sector's central competent authority designates within one hour after you become aware of it, and keep updating the report if the incident level changes (Article 11(1) and (2)). 72 hours36 hoursComplete damage-control or recovery operations and notify the sector authority within 72 hours of becoming aware of a level 1 or level 2 incident, or within 36 hours of becoming aware of a major incident (Article 13(1)). 1 monthSubmit an investigation, handling and corrective action report to the sector authority within one month after those operations, unless the authority agrees to extend the time (Article 13(2) and (3)). Status since 5 Jan 2026Read from the law library 26 October 2026
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting (Arts. 24 and 29 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated Sept. 24, 2025 (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective Dec. 1, 2025) as soon as the agency becomes awareNotify the central competent authority in charge of the relevant sector as soon as the agency becomes aware of a cyber security incident. Status since 1 Dec 2025Read from the law library 19 September 2026
Taiwan	Telecommunications Management Act, Announcement and Report of Service Suspension (Telecommunications Management Act (電信管理法), enacted June 26, 2019, Arts. 11 and 79) immediatelyWhen you cannot provide telecommunications services, in whole or in part, because of a disaster, a penalty imposed by the competent authority or another major incident, announce the suspension immediately (Article 11(1)). Status since 1 Jul 2020Read from the law library 26 October 2026
Vietnam	Circular on Information System Security in Banking Operations, Incident Reporting to the State Bank (Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), art. 54(1)) 24 hoursSend the State Bank (Information Technology Authority) a report on each cyber security incident, on the form in Appendix 01 to the Circular, within 24 hours starting from the detection of the incident (article 54(1)). 5 business daysSend the State Bank a further report within 5 working days after the incident has been handled, following the instructions in the Appendix (article 54(1)). Status since 1 Jan 2021Read from the law library 26 October 2026
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties (Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4)) immediatelyWhen a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report. Status since 1 Jul 2026Read from the law library 16 September 2026