Home › Law library › Data breach and incident reporting deadlines by country
Data breach and incident reporting deadlines by country
How fast you must report a personal data breach or a security incident, and to whom, under every law in our library. Each row comes from the law's own page, where every fact links to its official source.
31 laws in 20 jurisdictions. Library last updated 11 October 2026. = confirmed by two independent sources, at least one official. Rows marked “Being verified” are still being confirmed and are not given as answers.
| Law | Jurisdiction | Who to notify and how fast | Last verified |
|---|---|---|---|
| Cyber Resilience Act (CRA) | European Union | Actively exploited vulnerabilities and severe incidents: early warning within 24h, notification within 72h; final report 14 days after a fix (vulnerabilities) or 1 month after notification (incidents). Via ENISA Single Reporting Platform.✓ | 10 October 2026 |
| DORA | European Union | Major ICT incidents: initial notice within 4h of classifying as major and no later than 24h after awareness; intermediate report within 72h of initial notice; final report within 1 month of the latest intermediate report.✓ | 10 October 2026 |
| EU AI Act | European Union | Now: providers of general-purpose AI models with systemic risk must report serious incidents to the AI Office without undue delay (Art 55). From 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I): high-risk providers report serious incidents to the market surveillance authority within 15 days; 10 days if a death; 2 days for widespread infringements or serious critical-infrastructure disruption (Art 73).✓ | 10 October 2026 |
| NIS2 | European Union | Significant incidents to CSIRT/authority: early warning within 24h, incident notification within 72h, final report within 1 month of the notification. Inform service recipients where relevant.✓ | 10 October 2026 |
| EU GDPR | European Union (EEA) | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ | 10 October 2026 |
| Swiss nFADP (revDSG) | Switzerland | Notify the FDPIC as soon as possible if a breach is likely to cause a high risk; inform individuals where needed for their protection or if the FDPIC requires it. Processors must tell controllers as soon as possible.✓ | 10 October 2026 |
| Turkey KVKK | Türkiye | If personal data are obtained unlawfully by others, the controller must notify the Board and the affected people as soon as possible (Art 12(5)). Board Decision 2019/10 (24 Jan 2019) sets this as within 72 hours of learning of the breach, using the Board's breach notification form. Affected individuals are told within a reasonable time, directly where possible. There is no risk threshold, so all breaches are reportable.✓ | 10 October 2026 |
| UK GDPR / DPA 2018 | United Kingdom | Report notifiable breaches to the Information Commission without undue delay and, where feasible, within 72 hours. Tell affected individuals without undue delay if high risk. PECR breaches by telecoms providers: without undue delay and, where feasible, within 72 hours (PECR reg 5A(2), since 20 Aug 2025).✓ | 10 October 2026 |
| UK Online Safety Act | United Kingdom | No general incident-notification duty. Since 7 Apr 2026, regulated user-to-user services must report detected, unreported child sexual exploitation and abuse (CSEA) content to the National Crime Agency (UK providers: all such content; non-UK providers: UK-linked content), in the form and timeframes set by SI 2026/268. Content already reported to a qualifying foreign body such as NCMEC need not be re-reported. The duty is not yet applied to search services.✓ | 11 October 2026 |
| UK PECR | United Kingdom | Public electronic communications service providers (telecoms, ISPs) must notify the Information Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Give reasons if later. Notify affected subscribers/users without undue delay if likely to harm them. Keep a breach log. The old 24-hour deadline ended on 20 Aug 2025. Late notification can attract a £1,000 fixed penalty.✓ | 11 October 2026 |
| UK PSTI (connected products) | United Kingdom | On learning of a possible compliance failure, take all reasonable steps to investigate. If a failure is confirmed: manufacturers must stop supply and remedy it as soon as practicable and notify the enforcement authority, other manufacturers and the importers/distributors they supplied; importers and distributors must contact the manufacturer, stop supply if it is unlikely to be fixed, and notify the enforcement authority and those they supplied. Keep records of investigations and failures for 10 years.✓ | 11 October 2026 |
| LGPD | Brazil | Notify the ANPD (via its electronic form) and affected data subjects within 3 business days of learning of an incident that may cause relevant risk or damage (Resolution CD/ANPD 15/2024). Keep records of all incidents for at least 5 years. Deadlines doubled for small agents.✓ | 10 October 2026 |
| CCPA/CPRA | California, United States | Civil Code 1798.82 applies to any business doing business in California that holds computerised personal information, whether or not it meets the CCPA thresholds. As amended by SB 446 (from 1 Jan 2026): notify affected residents within 30 calendar days of discovering or being told of a breach (delay allowed for law-enforcement needs or to determine scope); if more than 500 residents must be notified, send the Attorney General a sample notice within 15 calendar days of notifying consumers.✓ | 10 October 2026 |
| PIPEDA | Canada (federal) | Report to the OPC and notify affected individuals as soon as feasible for any breach of security safeguards creating a real risk of significant harm (e.g., financial loss, identity theft, humiliation). Keep a record of every breach and provide it to the OPC on request.✓ | 10 October 2026 |
| Quebec Law 25 | Quebec, Canada | Notify the CAI and affected persons promptly of any confidentiality incident that presents a risk of serious injury; keep an incident register and give it to the CAI on request. The Act sets no fixed number of days.✓ | 10 October 2026 |
| Privacy Act / APPs | Australia | Notifiable Data Breaches scheme: assess a suspected breach within 30 days; if serious harm is likely, notify the OAIC and affected individuals (or publish a statement if direct notice is impractical).✓ | 10 October 2026 |
| PIPL | China | PIPL: act immediately and notify regulators and affected people (individual notice can be skipped if harm is effectively avoided, unless regulators order it). National Cybersecurity Incident Reporting Measures (from 1 Nov 2025), for incidents graded 'relatively major' or above: critical information infrastructure operators within 1 hour (to the CII protection department and public security), state organs within 2 hours (to their CAC office), other network operators within 4 hours (to the provincial CAC); summary report within 30 days after the incident is closed. | 10 October 2026 |
| DPDP Act / DPDP Rules | India | From 13 May 2027 (DPDP Rule 7): inform the Board without delay and file a detailed report within 72 hours of becoming aware (extendable by the Board); tell each affected person without delay in plain language. In force now: report specified cyber incidents to CERT-In within 6 hours (CERT-In Directions, 28 Apr 2022).✓ | 10 October 2026 |
| APPI | Japan | Preliminary report to the PPC promptly (guidance: about 3-5 days), final report within 30 days (60 days if malicious, e.g. cyberattack). Notify affected individuals promptly; public notice if direct notice is impossible. | 10 October 2026 |
| PDPA | Singapore | Assess a suspected breach within 30 days. Notify the PDPC as soon as practicable and no later than 3 days after deciding it is notifiable. Notify affected individuals as soon as practicable if significant harm is likely. Processors must alert the organisation without undue delay. | 10 October 2026 |
| PIPA | South Korea | Notify affected individuals within 72 hours of becoming aware. Report to the PIPC or KISA within 72 hours if 1,000+ people, sensitive or unique ID data, or outside hacking is involved. From 11 Sep 2026 notice also covers possible breaches and forgery or alteration (e.g. ransomware).✓ | 11 October 2026 |
| ADGM DPR | Abu Dhabi Global Market (UAE free zone) | Notify the Commissioner within 72 hours of becoming aware, unless unlikely to risk individuals' rights; explain any delay. Tell affected people without undue delay if the breach is high risk.✓ | 10 October 2026 |
| DIFC DPL | Dubai International Financial Centre (UAE free zone) | Notify the Commissioner as soon as practicable of any breach that compromises data subjects' confidentiality, security or privacy (there is no fixed hour deadline). Tell affected individuals as soon as practicable if the breach is high risk. Use the DIFC Personal Data Breach Reporting Form.✓ | 10 October 2026 |
| Israel PPL / Amendment 13 | Israel | Under Data Security Regulations 2017, reg. 11(d), a controller must immediately notify the Privacy Protection Authority (the Registrar) of a 'severe security incident' and report what it did in response. The PPA may order notice to data subjects who could be harmed (reg. 11(d)(2)), after consulting the National Cyber Directorate. Since its September 2022 policy, the PPA expects a report as soon as a severe incident is reasonably suspected, not only once it is confirmed. 'Severe' is defined in reg. 1 by security level: for high-security databases, any unauthorised use or integrity breach; for medium-security databases, unauthorised use of a substantial part of the database.✓ | 11 October 2026 |
| NDPA / GAID | Nigeria | Notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals' rights; notify affected people immediately if high risk.✓ | 10 October 2026 |
| Saudi PDPL | Saudi Arabia | Notify SDAIA through the National Data Governance Platform within 72 hours of becoming aware of a breach that may harm personal data or data subjects, or conflict with their rights or interests (Implementing Regulation Art. 24). Also notify affected data subjects where the breach may damage their data or conflict with their rights or interests (PDPL Art. 20(2)).✓ | 11 October 2026 |
| POPIA | South Africa | Notify the Information Regulator and affected people as soon as reasonably possible after discovering a security compromise (s22). Since 1 April 2025, reports must go through the Regulator's e-Portal.✓ | 10 October 2026 |
| UAE PDPL | United Arab Emirates (onshore; excludes DIFC and ADGM free zones) | Notify the Data Office immediately on becoming aware of a breach that harms privacy (Art. 9); exact deadline and procedure await the Executive Regulations.✓ | 10 October 2026 |
| PECA | Pakistan | PECA sets no general breach-notification duty for businesses; sectoral rules (PTA, SBP) apply.✓ | 10 October 2026 |
| Pakistan PDP Bill | Pakistan | Proposed: notify the Commission and affected people without undue delay, within 72 hours where feasible (not in force).✓ | 10 October 2026 |
| Pakistan SBP/PTA data rules | Pakistan | SBP: report all security incidents and breaches to SBP under its Enterprise Technology Governance & Risk Management Framework (the cloud framework sets no hour limit). PTA: the revised CTDISR-2025 reportedly requires major incidents to be reported within 24 hours (news report; PTA text not seen).✓ | 10 October 2026 |
Work out your exact GDPR deadline with the Breach 72-Hour Deadline calculator
Information only, not legal advice. Laws change; open the law page and its official source before relying on a row. Spotted an error? Email contact@