NIST Privacy Framework, Communicate-PCM.AW-P7

Notify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later.

Communicate a personal data breach likely to result in a high risk to the rights and freedoms of individuals to the affected data subject, in clear and plain language, without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

Notify the National Center for Personal Data Protection immediately, and in any case no later than three working days after becoming aware of a violation of your personal data protection systems, under Article 16, unless the Center itself provides otherwise.

Notify the GBA/APD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Belgium, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Where feasible, notify the Data Protection Commissioner of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to risk a person's rights and freedoms.

Where a personal data breach is likely to result in a high risk to a person's rights and freedoms, notify that person without undue delay and, where feasible, not later than 70 hours after becoming aware of it.

Notify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data.

As a processor, warn the controller without delay of any security breach affecting personal data you process on the controller's behalf.

Notify the Privacy Commissioner, then any affected individual, without undue delay of a breach of security that is likely to adversely affect an individual.

Describe in the Commissioner notification the nature of the breach, its likely consequences, and the measures taken and to be taken to address it.

Notify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later.

As a processor, notify the controller without undue delay after becoming aware of a personal data breach.

Notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the affected person's rights and freedoms, and give reasons for any later notification.

As a data processor, notify the data controller of a personal-data breach without undue delay after becoming aware of it.

Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects, within the reasonable period the ANPD sets by regulation, and state the reasons for the delay when the notice is not immediate.

Describe in the notification the nature of the personal data affected, the data subjects involved, the technical and security measures used, the risks related to the incident, and the measures taken or planned to reverse or mitigate its effects.

Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 7) took effect 1 January 2026 under Government Gazette No. S 11/2025, an organisation to notify the Authority within 3 days of assessing that a breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, and to notify each affected individual, for a breach involving any personal data including a voiceprint or faceprint.

If you provide public electronic communications services, notify the KZLD within three days of establishing a personal data breach (Electronic Communications Act Article 261в, paragraph 1).

Promptly notify the affected user or other person where the breach may adversely affect their personal data or privacy, unless you have shown the KZLD that appropriate technological protection measures were applied to the data concerned (Article 261в, paragraphs 2 and 3).

Notify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Bulgaria, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify the CNPD of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals' rights, freedoms and guarantees at risk, and state the reasons for the delay if you notify later (Article 27(1) and (2)).

Make the notification to the CNPD describe the nature of the breach, including where possible the categories and approximate number of data subjects affected, its likely consequences and the measures you have taken or propose, and keep it confidential (Article 27(3)).

Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.

Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents.

A data controller must notify the Ministry of Post and Telecommunications immediately, but no later than 72 hours of becoming aware of a personal data breach that may pose a risk to the data subject or another natural person, or give the Ministry valid reasons for any delay.

A data controller must notify the affected data subject immediately upon becoming aware of a personal data breach that may pose a high risk to their rights and freedoms, unless the controller has already secured the data, has taken steps removing the high risk, or individual notice would be disproportionately burdensome, in which case a public notice serves instead.

Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.

Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.

Notify the Ombudsman and each affected data subject of a personal data breach without undue delay and no later than five days after you should, with the exercise of reasonable diligence, have been aware of it, describing the breach, its consequences, and the measures taken or recommended (section 16(1)).

Notify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data.

Include in any breach notice the categories of information involved, the cause, possible harm, remedial steps taken, what affected individuals can do to protect themselves, and the handler's contact information.

As a data processor, notify the Superintendencia de Industria y Comercio under the same terms when a security code violation creates that risk; neither duty requires telling the affected data subject directly.

If you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred.

Notify the Colorado Attorney General of a security breach affecting 500 or more Colorado residents without unreasonable delay and not later than 30 days after the date of determination that a security breach occurred; also notify nationwide consumer reporting agencies if more than 1,000 residents are affected.

Notify each affected Connecticut resident of a breach of security involving personal information without unreasonable delay and no later than 60 days after discovery, unless federal law requires a shorter time.

Notify the Connecticut Attorney General of the breach not later than the time when you notify affected residents (section 36a-701b(b)(2)(A)).

Notify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, unless the breach is unlikely to risk their rights and freedoms.

Notify UOOU without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Czech Republic, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify affected Delaware residents of a breach of security without unreasonable delay and no later than 60 days after determining the breach occurred.

Notify the Delaware Attorney General, by the time you notify residents, if the breach affects more than 500 Delaware residents.

Notify the Data Protection Authority and the affected data subject without delay of any breach affecting personal data, describing the nature of the breach, the categories and approximate number of affected people and records where possible, a contact point, the likely consequences, and the measures taken or proposed to address it.

As a processor, warn the controller without delay of any breach of security affecting personal data you process on the controller's behalf.

Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, unless the breach is unlikely to risk their rights and freedoms.

If your business conducts business in the District of Columbia and discovers a breach of the security of a system containing a District resident's personal information, notify each affected resident in the most expedient time possible and without unreasonable delay.

If the breach affects 50 or more District residents, also give written notice to the Office of the Attorney General for the District of Columbia, no later than when you notify residents.

Notify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window.

Tell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms.

Notify the Authority and the telecommunications regulator of a personal-data security breach as soon as possible and no later than five days after becoming aware of it.

Notify the affected data subject within 3 days of learning of the risk, where the breach carries a risk to their fundamental rights and individual freedoms.

Notify the Personal Data Protection Center of any personal data breach within 72 hours of the breach, and notify immediately where the breach relates to national security protection concerns.

Notify the Data Subject within 3 days of the date you notified the Center, telling them of the infringement and the procedures you have adopted about it.

Notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and every affected data subject of a personal data breach within seventy two hours of becoming aware of it.

Tell the Agencia de Ciberseguridad del Estado, in clear and simple language, the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations for the data subject, and where to learn more, and give the affected data subject the incident's nature, the data compromised, the recommendations, and where to learn more.

Notify the Estonian Data Protection Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Estonia, unless the breach is unlikely to risk their rights and freedoms.

Notify the Eswatini Communications Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.

Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.

Notify the Authority of a personal data breach within 72 hours of becoming aware of it, giving reasons for any delay.

Communicate a personal data breach to the affected data subject within 72 hours of becoming aware of it, in clear language, describing the likely consequences, the contact point for more information and the measures taken to address it.

If you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)).

Where all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)).

If you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)).

Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)).

Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms.

Notify the Data Protection Ombudsman without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Finland, unless the breach is unlikely to risk their rights and freedoms.

Notify the Florida Department of Legal Affairs of a breach of security affecting 500 or more individuals in Florida as expeditiously as practicable, and no later than 30 days after determining a breach occurred or having reason to believe one occurred.

If you need 15 additional days to notify affected individuals, give the Florida Department of Legal Affairs written notice of good cause for the delay within 30 days after determining a breach occurred or having reason to believe one occurred.

Notify the CNIL without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in France, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify the APDPVP without delay of a personal-data breach, describing its nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address it; the law sets no numeric deadline for this notice.

Accompany a notification to the APDPVP with supporting evidence of the breach.

Notify the Information Commission of a personal data breach within 72 hours of becoming aware of the breach.

Notify each affected data subject of a personal data breach without undue delay where the breach carries a high risk to their rights.

Give notice of a breach of the security of a system containing a Georgia resident's personal information in the most expedient time possible and without unreasonable delay.

Notify the information broker or data collector you maintain data for of any breach you discover within 24 hours following discovery, so that party can meet its own notice duty.

An app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights.

Notify the competent data protection authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Germany, unless the breach is unlikely to risk their rights and freedoms.

Notify the Data Protection Commission and the affected data subject as soon as reasonably practicable after you have reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person.

Give the data subject enough information in the notification to take protective measures against the consequences of the breach, including the identity of the unauthorised person if known, and communicate it by registered mail, electronic mail, the website, media publication, or another manner the Commission directs.

Notify the Hellenic Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Greece, unless the breach is unlikely to risk their rights and freedoms.

If you hold a Guam resident's computerized personal information for another owner or licensee rather than for yourself, notify that owner or licensee as soon as practicable after discovering a breach.

Provide clear and conspicuous notice, without unreasonable delay, to a Hawaii resident affected by a security breach of a system containing their personal information, describing the incident, the type of information exposed, and remedial steps taken.

If you provide a publicly available electronic communications service in Hungary, notify the National Media and Infocommunications Authority without delay when you detect a breach of subscriber personal data, meaning accidental or unlawful handling or processing of the personal data you transmit, store or otherwise handle in providing the service (Eht. section 156, paragraphs 2 and 3).

Where a breach is likely to harm a subscriber's or another individual's personal data or privacy, also notify that person without undue delay, unless you satisfactorily show the Authority that you applied appropriate technical protection measures to the data affected (Eht. section 156, paragraph 5).

Notify NAIH without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Hungary, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify Personuvernd without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Iceland, unless the breach is unlikely to risk their rights and freedoms.

Notify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual.

Notify the Illinois Attorney General once a single breach requires you to notify more than 500 Illinois residents, in the most expedient time possible and without unreasonable delay, and in no event later than when you notify those residents.

An app must notify the Data Protection Board and each affected data principal of a personal data breach, including one covering a biometric identifier, without delay, and must supply the Board a detailed follow-up report within 72 hours of becoming aware of the breach.

Notify the Indiana Attorney General of any breach disclosure, and notify each nationwide consumer reporting agency if the breach affects more than 1,000 Indiana consumers.

Make every disclosure or notification the statute requires, including notice to the Indiana Attorney General, notice to each nationwide consumer reporting agency, and a data holder's notice to the data base owner, without unreasonable delay and no later than 45 days after discovering the breach.

An app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 72 hours to the affected individual and to the supervisory institution, describing the data disclosed and the remedial measures taken.

Notify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay.

Notify the Iowa Attorney General's consumer protection division within five business days of notifying consumers, if the breach requires notifying more than 500 Iowa residents.

Notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms.

Notify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Italy, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Report any security breach in respect of your operations which affects or may affect personal data, and any contravention of the data protection standards, to the Information Commissioner within 72 hours of becoming aware of the breach or contravention, in the prescribed form and manner.

Notify the Information Commissioner without undue delay of any breach of your security measures which affects or may affect personal data.

An app that suffers a leak, loss, or damage of personal data belonging to a person in Japan must report the incident to the Personal Information Protection Commission where it is likely to harm the data subject's rights and interests, following PPC-prescribed procedure and timing.

An app that suffers a serious breach of data security or safety that could cause significant harm to an individual in Jordan must notify the affected individuals within 24 hours of discovery and must notify the Unit within 72 hours of discovery with the source, mechanism, and affected individuals; a Controller found grossly negligent or engaged in misconduct in a breach is liable to compensate the affected Data Subject.

Give notice to each affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay, if the investigation shows misuse occurred or is reasonably likely. There is no fixed numeric deadline in the statute; do not rely on a 45-day figure some secondary sources describe.

Notify each nationwide consumer reporting agency if more than 1,000 Kansas consumers are affected by one breach.

Immediately notify the affected Kansas student, or the student's parent or guardian, of a breach or unauthorized disclosure of student data if your entity has access to that data.

Notify an affected Kentucky resident of a breach involving unencrypted personal information in the most expedient time possible and without unreasonable delay.

Notify each nationwide consumer reporting agency if more than 1,000 persons are affected at one time.

Notify the Data Commissioner within seventy-two hours of becoming aware of a personal data breach that carries a real risk of harm, giving reasons if you notify later.

As a data processor, notify the data controller within forty-eight hours of becoming aware of a breach where reasonably practicable, and otherwise without delay (section 43(3)).

Notify the Digital Transformation Office of a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, as soon as practicable after becoming aware of the breach.

Notify each affected data subject of that same harmful personal data breach as soon as practicable after becoming aware of the breach, or by public notification through widely used media where direct notification is not feasible or would involve disproportionate effort or expense.

Notify the Agency for Information and Privacy of a personal data breach without delay and, where feasible, no later than seventy-two hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Give reasons for the delay if notifying the Agency after that seventy-two-hour period.

Notify the Data State Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Latvia, unless the breach is unlikely to risk their rights and freedoms.

Notify the Data Protection Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.

Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.

Notify the competent supervisory authority, the Datenschutzstelle in Liechtenstein, of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Notify VDAI without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Lithuania, unless the breach is unlikely to risk their rights and freedoms.

If you provide public electronic communications networks or services, notify the State Data Protection Inspectorate without delay of a personal data security breach (Law on Electronic Communications Article 74, paragraph 4).

Notify the subscriber, registered user or other person without delay where the breach may adversely affect the security of their data or their privacy, unless you prove to the Inspectorate that appropriate technical measures made the data inaccessible to unauthorized persons (Article 74, paragraphs 4 and 5).

Notify each affected Louisiana resident of a breach involving personal information in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery.

If you delay notice, notify the Attorney General in writing of the reasons for the delay within the 60 days after discovery of the breach (R.S. 51:3074(E)).

Notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Luxembourg, unless the breach is unlikely to risk their rights and freedoms.

Notify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope, absent a law enforcement delay.

Where a law enforcement investigation delays notice, notify affected Maine residents no later than 7 business days after a law enforcement agency determines that notification will not compromise a criminal investigation (10 M.R.S. 1348(3)).

A Controller must notify the Data Protection Authority within 72 hours of coming to know of, or reasonably believing in, a personal data breach involving special categories of personal data or data that could enable identity theft or fraud.

The same section requires the affected data subjects to be told, on the same seventy-two-hour period and on the same trigger.

Notify the IDPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Malta, unless the breach is unlikely to risk their rights and freedoms.

Notify each affected Maryland individual as soon as reasonably practicable, and no later than 45 days after discovering or being notified of the breach, once you determine a likelihood that personal information has been or will be misused.

If you maintain computerized data that you do not own or license, notify the owner or licensee of a breach as soon as reasonably practicable, and no later than 10 days after you discover or are notified of the breach (Com. Law 14-3504(c)).

Notify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information.

Notify the Data Protection Commissioner without undue delay, and where feasible within 72 hours, of becoming aware of a personal data breach, giving reasons if notification is later.

Communicate a personal data breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, unless an exception in section 26(3) applies.

Notify the affected data subject immediately of the breach, occurring at any stage of processing personal data, that significantly affects their patrimonial or moral rights.

Disclose a breach of the security of the system to an affected Minnesota resident in the most expedient time possible and without unreasonable delay. Minnesota sets no fixed numeric-day cap on notice to residents, unlike several peer states.

Notify the data owner immediately upon discovering a breach if you maintain, but do not own, the affected data.

Disclose a breach of security to all affected Mississippi individuals without unreasonable delay, unless your investigation reasonably determines the breach will not likely result in harm.

Notify each affected Missouri consumer of a breach of security involving their personal information without unreasonable delay.

Notify the Missouri Attorney General's office and every nationwide consumer reporting agency without unreasonable delay if you provide notice to more than 1,000 consumers at one time.

Notify the National Centre for Personal Data Protection without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Moldova, unless the breach is unlikely to risk their rights and freedoms.

Communicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language.

Notify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to create a risk to the rights and freedoms of the persons concerned, and give the reasons for the delay when you notify later than that.

Communicate a personal data breach to the affected person as soon as possible, in clear language, when it is likely to create a high risk to their rights and freedoms.

Notify affected Montana residents of a breach of security without unreasonable delay, and simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office.

Notify the Nebraska Attorney General no later than when you notify the affected resident, if notice to the resident is required.

Notify the AP without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Netherlands, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, subject to UAVG Article 42's national exception.

If you provide a public electronic communications service, notify the Autoriteit persoonsgegevens without delay of a security breach that adversely affects personal data processed in connection with the service in the European Union (Telecommunicatiewet Article 11.3a, paragraph 1).

Notify the person whose personal data is concerned without delay where the breach is likely to have adverse effects on their privacy, unless the Autoriteit persoonsgegevens finds that appropriate technical protection measures made the data unintelligible to anyone without a right of access (Article 11.3a, paragraphs 2 and 5).

Disclose a security breach of personal information to an affected Nevada resident in the most expedient time possible and without unreasonable delay. Nevada sets no fixed numeric deadline.

Notify consumer reporting agencies once notice is required for more than 1,000 residents.

Report a breach of security involving computerized personal records to the New Jersey Division of State Police before notifying the affected customer.

Disclose the breach to each affected New Jersey resident in the most expedient time possible and without unreasonable delay. New Jersey sets no fixed numeric-day cap.

Notify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery.

Notify the New Mexico Attorney General's office and the major consumer reporting agencies that compile files nationwide of a security breach affecting more than 1,000 New Mexico residents in the most expedient time possible and no later than 45 calendar days, and tell the Attorney General how many residents were notified and send it a copy of the resident notice within 45 calendar days following discovery of the breach (Section 10).

Disclose a breach of the security of your system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach.

Notify the New York Attorney General, the Department of State, and the Division of State Police of the breach, and notify each nationwide consumer reporting agency if you are notifying more than 5,000 New York residents at once.

Notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused or be likely to cause serious harm, has occurred.

Notify each affected individual, or give public notice if individual notice is not reasonably practicable, as soon as practicable after becoming aware of a notifiable privacy breach, unless a statutory exception or permitted delay applies.

Where the personal data affected belong to a member of the National Police or the Army of Nicaragua, and the security measures the law requires fail or are not observed, immediately inform the affected institution of the breach.

Notify the HAPDP of a personal data breach without delay after becoming aware of it, and justify to the HAPDP any notification made outside that timeframe.

Notify the affected person of a personal data breach as soon as possible when it is likely to create a high risk to their rights and freedoms; you need not notify the person where it is reasonable to believe the breach creates no such risk.

Notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned.

Notify affected data subjects immediately after becoming aware of a breach likely to result in a high risk to their rights and freedoms.

Notify each affected North Carolina resident of a security breach involving their personal information without unreasonable delay, consistent with the legitimate needs of law enforcement.

Notify the Consumer Protection Division of the North Carolina Attorney General's Office of every breach requiring notice to any affected person, not only breaches above the 1,000-person threshold.

Disclose a breach of the security system to any affected North Dakota resident in the most expedient time possible and without unreasonable delay.

Disclose the breach to the North Dakota Attorney General by mail or electronic mail if it exceeds 250 individuals.

Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Norway, unless the breach is unlikely to risk their rights and freedoms.

Notify every nationwide consumer reporting agency without unreasonable delay if a single breach affects more than 1,000 Ohio residents.

Provide notice of a breach of security involving personal information without unreasonable delay.

If personal health information in your custody or control is stolen or lost, or is used or disclosed without authority, notify the individual at the first reasonable opportunity and state in the notice that the individual is entitled to make a complaint to the Commissioner.

Notify the Commissioner at the first reasonable opportunity when the theft, loss or unauthorized use or disclosure meets a prescribed circumstance: reasonable grounds to believe the information was used or disclosed without authority by a person who knew or ought to have known that, reasonable grounds to believe it was stolen, further unauthorized use or disclosure after an initial incident, a pattern of similar incidents, a notice you must give a College, or your own determination that the incident is significant after weighing sensitivity, volume, the number of individuals and the number of custodians or agents responsible.

Notify each affected Oregon consumer of a breach of security, including one you learn of through a vendor, in the most expeditious manner possible and not later than 45 days after discovering or receiving notification of the breach, and notify the Oregon Attorney General as well once more than 250 Oregon consumers are notified (ORS 646A.604(1), (3)).

If you are a vendor that discovers a breach of security or has reason to believe one has occurred, notify each covered entity you have a contract with as soon as is practicable and not later than 10 days after discovering the breach or having reason to believe it occurred, and if you contract with another vendor that serves a covered entity, notify that vendor the same way (ORS 646A.604(2)).

Notify the affected data subject as soon as possible after learning that their personal data was stolen without authorization or that its security was otherwise compromised. This Law sets no fixed number of hours or days for that notice and no duty to notify ANTAI of the breach.

As an operator of a public communications network, tell affected data subjects about a particular breach of your network's security and the measures you are taking, again with no fixed period stated.

Notify the National Data Protection Agency, and the affected person where relevant, of a security incident within 72 hours of becoming aware of it.

Meet the conditions and requirements that the regulation of the law sets for that notification; article 17 leaves them to the regulation.

Notify each affected Pennsylvania resident of a breach of system security involving personal information without unreasonable delay.

Notify each nationwide consumer reporting agency if you notify more than 500 persons of a breach at one time.

Notify UODO without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Poland, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, unless the breach is unlikely to risk their rights and freedoms.

Notify affected Puerto Rico residents of a security breach of an information bank containing their personal information as expeditiously as possible.

Report the breach to the Department of Consumer Affairs within ten non-extendable days of detecting it.

Where the incident presents a risk of serious injury, judged by the sensitivity of the information, the anticipated consequences and the likelihood of injurious use, promptly notify the Commission d’accès à l’information and each person whose personal information is concerned.

Notify the national commission of a personal-data breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons.

Communicate the breach to the affected data subject without undue delay, in clear and simple terms, where it is likely to create a high risk to their rights and freedoms.

Notify affected Rhode Island residents of a breach posing a significant risk of identity theft within 45 days of confirming the breach, or within 30 days if you are a state or municipal agency.

Notify the Attorney General and consumer reporting agencies once more than 500 Rhode Island residents are affected, without delaying notice to residents.

Notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Romania, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

If you provide publicly available electronic communications services, notify the ANSPDCP without delay of a personal data security breach (Law 506/2004 Article 3, paragraph 6).

Notify the subscriber or other person without delay where the breach could affect their personal data or private life, unless you have shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned (Article 3, paragraphs 7 and 8).

Notify Roskomnadzor within 24 hours of detecting an unlawful or accidental transfer, provision, distribution, or access to personal data of a person in Russia, and file a full follow-up report within 72 hours.

Notify the supervisory authority of the breach within 48 hours of becoming aware of it.

As a data processor, notify the data controller of the breach within 48 hours of becoming aware of it.

Notify the Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in San Marino, under Article 34.

Communicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language.

Notify the Commissioner of a breach that may create risk to a person's rights and freedoms without undue delay, and within 72 hours of becoming aware of the breach where that is possible; give reasons for any delay beyond 72 hours.

As a processor, notify the controller without undue delay after becoming aware of a breach.

Notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, giving reasons for any later notification.

Promptly inform the affected data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms.

An app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies.

If you provide public communications services, notify the Agency for Communication Networks and Services (AKOS) without delay of a personal data security breach (ZEKom-2 Article 227, paragraph 1).

Notify the affected subscriber or individual without undue delay where the breach is likely to harm their personal data and privacy, unless you have satisfactorily shown the agency that appropriate technical protection measures were applied to the data concerned (Article 227, paragraphs 2 and 3).

Notify the Slovenian Information Commissioner without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Slovenia, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

Notify the Data Protection Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within 72 hours after becoming aware of it.

Where you extend that deadline for the legitimate needs of law enforcement or to determine the scope of the breach, tell the Authority the grounds for the extension, with supporting evidence, before the original deadline expires.

Notify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard.

Notify the affected data subject of the same security compromise as soon as reasonably possible after discovery, in writing, unless a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation, or the data subject's identity cannot be established.

Notify each affected South Carolina resident of a breach of security involving personal identifying information in the most expedient time possible and without unreasonable delay.

Notify the Consumer Protection Division of the Department of Consumer Affairs and all nationwide consumer reporting agencies if you notify more than 1,000 persons of a breach at one time.

Notify each affected South Dakota resident of a breach of system security not later than 60 days after discovery, absent a law enforcement delay.

Notify the South Dakota Attorney General by mail or electronic mail if a breach affects more than 250 South Dakota residents. This threshold is 250, not 250,000.

Notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Spain, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

An app that suffers a personal data breach in Sri Lanka, including one involving a biometric identifier, must notify the Data Protection Authority in the form, manner, and time a rule made under the Act determines; whether and when the affected individual must also be told is set by a rule not yet located.

Notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay, and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; if you do not notify within 72 hours, state the reasons for the delay.

Include in that notice, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, your data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

Notify IMY without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Sweden, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, unless the incident is one that must be reported under the Protective Security Act (2018:585) or notified under the Act (2019:109) on protective security in the Riksdag and its authorities, which Dataskyddslagen chapter 1 section 4 takes outside Articles 33 and 34.

Notify the FDPIC as soon as possible once you become aware of a data security breach likely to result in a high risk to a Swiss data subject's personality or fundamental rights.

Notify the affected individual only where necessary to protect them or where the FDPIC orders it; there is no fixed statutory hour count as there is under GDPR.

Notify the Authority immediately on becoming aware of the breach, and expect the Authority to immediately notify the competent authorities where the breach concerns national security matters.

Notify the Authority within 72 hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's contact details, the breach's likely effects, the measures taken or proposed to address it, and documentation of the breach and the corrective action taken.

Notify the Texas Attorney General as soon as practicable and no later than 30 days after determining the breach occurred, if the breach affects 250 or more Texas residents.

Notify each nationwide consumer reporting agency if you must notify more than 10,000 persons of the breach at one time.

An app that experiences a personal data breach affecting an individual in Thailand must notify the Personal Data Protection Committee's Office without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the affected individuals; where the breach is likely to cause high risk, the app must also notify each affected individual without delay.

Notify the Privacy Commission within 72 hours of becoming aware of a personal information breach that is likely to result in a risk to the rights and freedoms of individuals, describing its nature and, where possible, the categories and approximate numbers of data subjects and records concerned.

As a data processor, notify the data controller or the data processor that engaged you within 72 hours of becoming aware of a personal information breach, and answer their information requests without undue delay.

Notify the National Information Technology Authority immediately after you believe personal data has been accessed or acquired by an unauthorised person, describing the access or acquisition and the remedial action taken.

Wait for the Authority to determine whether you must also notify the affected data subject of the breach; the Act sets no separate deadline for that notice.

Notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.

Include in that notification the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.

Notify the Information Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in the United Kingdom, unless the breach is unlikely to risk their rights and freedoms.

Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.

Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.

Notify the Secretary of Health and Human Services of a breach of unsecured protected health information involving 500 or more individuals contemporaneously with the notice to affected individuals.

Notify an affected Virgin Islands resident without unreasonable delay after discovering that unencrypted personal information (a name combined with a Social Security number, driver's license number, or financial account number with its access code) was acquired without authorization.

Where direct notice is impractical because of cost, the number of residents affected, or insufficient contact information, give substitute notice by email, a conspicuous website posting, and notice to major territory-wide media.

Notify the affected data subjects immediately and in detail on becoming aware of the breach, describing the measures adopted to address it.

If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.

Notify the Utah Attorney General and the Utah Cyber Center if the breach affects 500 or more Utah residents, and notify nationwide consumer reporting agencies if it affects 1,000 or more.

Notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery.

An app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours.

Notify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery.

Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.

Notify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered.

Notify each affected West Virginia resident of a breach of security involving personal information without unreasonable delay.

Give notice as soon as possible to each affected Wyoming resident once your investigation determines misuse of their personal identifying information has occurred or is reasonably likely.

Notify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it.

Notify the affected data subject as soon as practicable of any security breach affecting their personal data.

Treat every security breach affecting the data you process as notifiable under section 19: the Act sets no risk threshold below which the duty falls away.

Report a personal data breach to the Authority within 24 hours of becoming aware of it, on Form DP3 in the Fourth Schedule.

Inform the affected data subjects within 72 hours where the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms.

Notify the supervisory body, the identifiable affected individuals, the public if it is of public interest and, where applicable, other relevant competent authorities of any security breach or disruption in the provision of the service, or in the implementation of the Article 19a(1), point (a), measures, that has a significant impact on the trust service provided or on the personal data maintained in it (Article 19a(1), point (b)).

Make each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)).

Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.

Notify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it.

If you are a telecommunications operator (teleyritys) providing a communications service in Finland, notify your subscribers and users without delay when a significant information-security breach, or another event that prevents the service from working or materially disturbs it, affects or threatens your service (Act 917/2014, section 274).

If you provide a value-added service as a value-added service provider (lisäarvopalvelun tarjoaja), notify your users without delay of a significant information-security breach, or the threat of one, affecting your service (section 274).

Where a particular risk of a breach of the security of your services persists despite your safeguards, inform your subscribers of the risk and of the measures they may take to protect themselves.

Identify in that notice any software or encryption technology available to the subscriber to protect the security of their communications.

Without undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response.

Where appropriate, notify the recipients of your service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.

If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.

In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.

Where relevant, immediately inform your service recipients, including affected network or system users, of protective measures they can take, and, after coordinating with the competent institution, inform them of the significant incident or threat itself, unless disclosure would create a new significant-incident risk or conflict with national security.

Where appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat.

Where there is a particular and significant threat of a security incident, inform the users who may be potentially affected of any possible protective measures or remedies they can take and, where appropriate, of the threat itself (regulation 28(7)).

Notify the Authority forthwith, and in any case no later than three working days after the breach, of any breach of your information security that adversely affects the confidentiality of information relating to players (article 37(2)(c)).

Submit the notice as an incident report through the Licensee Portal of the Malta Gaming Authority.

Where appropriate, notify the recipients of your services without undue delay of a significant incident likely to adversely affect those services, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.

Inform your clients of a vulnerability in your information systems, or of a breach that could affect them.

Where appropriate, inform the recipients of your service of the incident and of any measures they can take in response (Article 30).

Where a serious cyber threat arises, inform the users of your services who may be affected of the preventive measures they can take, and inform them of the threat itself unless doing so would increase the risk to information-system security; where a significant incident has an adverse effect on your service, inform the affected users of the incident.

Where relevant, notify the recipients of your services of a significant incident that could affect them.

Notify the users of your service, without delay, of an incident that causes or may cause a harmful effect on providing or using your service, together with any measures they can take to reduce or remove the harmful effect.

Without delay, inform the recipients of your services of a significant incident likely to adversely affect them, and communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response.

As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.

Where appropriate, inform your service recipients, as soon as you can, of a significant incident likely to adversely affect the service you provide to them.

For a significant cyber threat, inform affected service recipients, as soon as you can, of the protective and remedial measures they can take, and, where appropriate, of the threat itself.