Regulatory clock card
On this page
The triage analyst does not decide notification. The analyst does decide whether counsel hears about a running clock in minutes or in days. This page is the recognition aid: what you can see, which clock it may start, how short that clock is, and who owns it.
Law as of October 13, 2026. Every row below was checked against the primary source listed in Sources on that date. Statutes and rules change; your compliance team’s list is authoritative, and anything marked “verify with counsel” was not confirmed from a public primary source.
Recognition aid, not legal advice
Whether a regime applies depends on jurisdiction, contracts and your organization’s role (controller or processor, covered entity or business associate, merchant or acquirer, manufacturer or user). The table tells you when to raise your hand and how fast. Privacy, legal and compliance decide whether a clock started and what gets filed.
How to use this page
Regulatory boundaries teaches the four moves: recognize, commit the timestamps, preserve, get the owner in. This page is the lookup table behind the first two. Use it in three steps.
- Recognize. Match what you can see in the case (the “What you see” column) against the rows. A plausible match is enough. You are flagging a candidate, not deciding applicability.
- Flag. Record the regime, the data class or trigger, the candidate start timestamp in UTC, and the owner you engaged and when, in the regulatory flags block. Your timestamp is a candidate; the owner decides which moment counts.
- Route. Engage the owner in the “Decision owner” column. For any clock measured in hours, that means the same hour, through the paging path in the escalation protocols, not a ticket for the morning.
Four things stay outside the analyst’s job: deciding that a regime applies, deciding that notification is required, contacting a regulator or law enforcement, and calling anything a “breach” in the record. The last one is a legal conclusion; write what you observed (see writing for discovery).
What “the clock starts at” means
Regimes start their clocks at different moments, and few of them wait for confirmation.
- Awareness or discovery. GDPR General Data Protection Regulation (GDPR) EU/EEA regulation on processing personal data. It applies where an Article 3 nexus exists (an EU/EEA establishment, offering goods or services to people in the EU, or monitoring their behavior). A personal-data breach must be reported to the supervisory authority within 72 hours of the controller becoming aware of it (Art. 33). Awareness means a reasonable degree of certainty that a security incident has compromised personal data (EDPB Guidelines 9/2022), not final confirmation, so the awareness timestamp belongs in the case record. , UK GDPR UK GDPR The GDPR as retained in UK law, enforced by the Information Commissioner's Office (ICO). Article 33 keeps the 72-hour notice to the authority after the controller becomes aware of a personal data breach. See Notification clocks. , NIS2, the CRA Cyber Resilience Act (CRA) EU Regulation 2024/2847 on products with digital elements. Since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents affecting their products through ENISA's Single Reporting Platform: an early warning within 24 hours and a notification within 72 hours. See Notification clocks. , HIPAA, Regulation S-P Regulation S-P (SEC) The SEC's privacy rule for brokers, dealers, investment companies and advisers, as amended in 2024: customer notice within 30 days of becoming aware of unauthorized access to sensitive customer information, and a 72-hour notice from service providers. Every covered institution has had to comply since 3 June 2026. See Notification clocks. and most state laws. Often reached during triage. Under GDPR, awareness Awareness (GDPR) The moment a GDPR controller becomes aware of a personal-data breach, which starts the 72-hour clock to notify the supervisory authority (Art. 33). The EDPB treats awareness as a reasonable degree of certainty that a security incident has compromised personal data (Guidelines 9/2022), not final confirmation. A short investigation to establish that is allowed, but the clock does not wait for the case to close, so record the awareness timestamp in the case. is a reasonable degree of certainty that a security incident has compromised personal data. Under HIPAA, discovery Discovery (HIPAA) Under the HIPAA Breach Notification Rule, a breach counts as discovered on the first day it is known to the covered entity, or would have been known with reasonable diligence, by any workforce member or agent other than the person who committed it (45 CFR 164.404(a)(2)). Discovery starts the 60-day outer limit for notifying individuals, so the triage record's first-knowledge timestamp matters. is the first day anyone in the workforce other than the wrongdoer knew, or would have known with reasonable diligence.
- Suspicion. Card-brand rules run from a reasonable suspicion of account-data compromise.
- A determination or classification. The US banking rule, NYDFS 500.17 NYDFS Part 500 (23 NYCRR 500) The New York Department of Financial Services cybersecurity regulation for its licensed entities. Section 500.17 sets a 72-hour notice of a cybersecurity incident, a 24-hour notice of an extortion payment and a written explanation of that payment within 30 days. See Notification clocks. , Texas and Colorado run from the organization’s determination that an incident occurred; DORA’s four hours run from classifying the incident as major. Those decisions must be made promptly, and your timestamps are the evidence that they were.
- Materiality. SEC Form 8-K Item 1.05 SEC Cybersecurity Disclosure Rule The US Securities and Exchange Commission's 2023 rule requiring public companies to disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality (a US Attorney General national-security or public-safety determination can delay it), and to describe their cybersecurity risk management annually. See Materiality (SEC). runs from the materiality determination Materiality (SEC) The test that triggers a US public company's cybersecurity disclosure: whether there is a substantial likelihood that a reasonable investor would consider the incident important. The company must make that determination without unreasonable delay after discovery, and Form 8-K Item 1.05 is due within four business days of determining that an incident is material. Triage does not decide materiality; it supplies the facts and timestamps the people who do decide will rely on. , which itself must come without unreasonable delay after discovery.
- Receipt of someone else’s notice. A processor’s notice to its controller, a vendor’s notice to you, or a law-enforcement call can be the start (see external notifications).
- A payment. Ransom and extortion payment reports Extortion Payment Notice A reporting duty triggered by paying a ransom or extortion demand, separate from incident notification: NYDFS within 24 hours, Australia within 72 hours, and CIRCIA within 24 hours once its final rule takes effect. See Ransom and extortion payments. run from the payment.
Recognition table
Each table gives the regime and its primary source, who it binds, the trigger an analyst can see, what starts the clock, the first deadline and its recipient, and the owner who decides. Later reports (intermediate, final, individual notices) are noted where they shape what the record must hold.
EU and UK
Law as of October 13, 2026.
| Regime and source | Who it binds | What you see | Clock starts at | First deadline, to whom | Decision owner |
|---|---|---|---|---|---|
| GDPR (Art. 33 and 34) | Controllers with an Article 3 nexus to the EU/EEA; processors, toward their controller | Personal data plausibly read, copied, altered, deleted, or made unavailable (ransomware encryption can be a loss of availability) | Awareness. For a processor’s incident, generally the processor’s notice to the controller | Supervisory authority without undue delay and, where feasible, within 72 hours, unless unlikely to result in risk. Data subjects without undue delay if high risk | DPO Data Protection Officer (DPO) The role GDPR (Art. 37-39) requires of some controllers and processors to advise on and monitor data-protection compliance and to act as the contact point for supervisory authorities. In triage, the DPO or privacy lead decides whether a personal-data breach is notifiable; the SOC supplies the facts and the awareness timestamp. |
| UK GDPR (Art. 33; ICO) | Controllers processing in a UK context | As for GDPR, for UK data subjects | Awareness | The ICO within 72 hours where feasible, unless unlikely to result in risk | DPO or UK privacy lead |
| UK NIS Regulations 2018 (reg. 11) | Operators of essential services and certain digital service providers in the UK | An incident with a significant impact on the continuity of an essential service | Awareness that a NIS incident occurred | Designated competent authority within 72 hours | Sector compliance owner and legal |
| NIS2 Network and Information Security Directive (NIS2) The EU directive (2022/2555) on cybersecurity for essential and important entities in sectors such as energy, transport, health, digital infrastructure and managed services, applied through each member state's national law. For a significant incident it sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Which entities are in scope, and to whom they report, depends on the member state. (Art. 23) | Essential and important entities in the directive’s sectors, through each member state’s national law | A significant incident: one that causes, or could cause, severe operational disruption or financial loss to the entity, or considerable damage to others | Awareness of the significant incident | Early warning to the CSIRT Computer Security Incident Response Team (CSIRT) The team that owns incident response once an incident is declared; also called a CIRT or IRT, and at national level often a CERT. In ASSURED it is the IR that escalation hands to: triage owns the case until the CSIRT accepts the handoff packet. or competent authority within 24 hours; incident notification within 72 hours; final report within one month of the notification | NIS2 compliance owner and legal |
| DORA Digital Operational Resilience Act (DORA) The EU regulation (2022/2554), applying since January 2025, on ICT risk at financial entities and their critical ICT providers. Major ICT-related incidents go to the competent authority in stages: an initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours, and a final report within one month. The regulation's classification criteria, not the SOC's severity label, decide what is major. (Art. 19; RTS 2025/301, Art. 5) | EU financial entities (banks, insurers, investment firms, payment institutions and others) | An ICT incident touching critical services, clients, data, or availability at a financial entity | Classification of the incident as major, capped by awareness | Initial notification to the competent authority within 4 hours of classification and no later than 24 hours after awareness; intermediate report within 72 hours of the initial notification; final report within one month of the last intermediate report | The entity’s incident-classification owner (ICT risk) |
| Cyber Resilience Act (Art. 14; ENISA) | Manufacturers of products with digital elements sold in the EU, since September 11, 2026 | Active exploitation of a vulnerability in a product your company makes, or a severe incident affecting a product’s security (a compromised build, signing or update pipeline) | Awareness | Early warning within 24 hours and notification within 72 hours, through ENISA’s Single Reporting Platform to the coordinating CSIRT and ENISA. Final report 14 days after a fix is available (vulnerability) or one month after notification (incident) | Product security (PSIRT) and legal |
Status to watch. The EU Digital Omnibus proposal (November 2025) would move GDPR Article 33 to 96 hours and notify only high-risk breaches. As of October 2026 it is still a proposal, so 72 hours applies. The UK Cyber Security and Resilience Bill would add a 24-hour initial notification to the NIS regime; it is still before the House of Lords and is not law. NIS2 runs through national law, so the recipient and the entity thresholds vary by member state.
US federal and sector
Law as of October 13, 2026.
| Regime and source | Who it binds | What you see | Clock starts at | First deadline, to whom | Decision owner |
|---|---|---|---|---|---|
| SEC Form 8-K Item 1.05 (SEC release) | US public companies | An incident affecting operations, data, or financial-reporting systems at a listed company | The materiality determination, made without unreasonable delay after discovery | Form 8-K within four business days. The US Attorney General can delay it on national-security or public-safety grounds | Disclosure committee and counsel |
| SEC Regulation S-P (compliance guide) | SEC-regulated firms such as broker-dealers, investment advisers, investment companies and transfer agents; all must comply since June 3, 2026 | Unauthorized access to sensitive customer information | Becoming aware that unauthorized access has occurred or is reasonably likely to have occurred | Affected individuals as soon as practicable, no later than 30 days. A service provider must notify the firm within 72 hours | Compliance and legal |
| FTC Safeguards Rule FTC Safeguards Rule The GLBA rule for non-bank financial institutions. A notification event involving the information of 500 or more consumers goes to the FTC within 30 days of discovery. See Notification clocks. (16 CFR 314.4(j)) | Non-bank financial institutions under FTC jurisdiction (the GLBA Safeguards Rule) | Unauthorized acquisition of unencrypted customer information of at least 500 consumers. Unauthorized access is presumed to be acquisition without reliable evidence otherwise | Discovery | The FTC as soon as possible, no later than 30 days, on the FTC’s online form | Compliance and legal |
| US banking 36-hour rule (12 CFR 53.3, with Federal Reserve and FDIC counterparts) | Banking organizations supervised by the OCC, Federal Reserve or FDIC; bank service providers | An incident that has materially disrupted or degraded, or is reasonably likely to, the bank’s operations or services | Determination that a notification incident Notification Incident (US Banking Rule) Under the US federal banking regulators' computer-security incident notification rule, an incident that has materially disrupted or degraded, or is reasonably likely to, a banking organization's operations. It starts a 36-hour notice to the primary federal regulator. See Notification clocks. occurred | Primary federal regulator as soon as possible, no later than 36 hours. A bank service provider notifies each affected bank as soon as possible when covered services are disrupted for four or more hours | Bank incident or compliance lead |
| GLBA interagency guidance (Federal Reserve) | Banks | Unauthorized access to sensitive customer information | Becoming aware of the incident | Primary federal regulator as soon as possible; customers as soon as possible once misuse has occurred or is reasonably possible | Compliance and legal |
| NYDFS 500.17 (23 NYCRR 500.17; DFS) | Entities licensed by the New York Department of Financial Services | A cybersecurity incident at the entity, an affiliate, or a third-party service provider | Determination that a cybersecurity incident occurred | The Superintendent as promptly as possible, no later than 72 hours. An extortion payment: notice within 24 hours of paying, and a written explanation within 30 days | Compliance and legal |
| HIPAA Health Insurance Portability and Accountability Act (HIPAA) U.S. legislation that sets standards for protecting sensitive patient health information, including specific security and privacy requirements. It applies to covered entities (health plans, clearinghouses, most providers) and their business associates; health data held by others is usually governed by other laws, such as the FTC Health Breach Notification Rule and state health-privacy statutes. Its Breach Notification Rule requires notice to individuals without unreasonable delay and no later than 60 days after discovery, notice to prominent media when a breach affects more than 500 residents of a state, and documentation kept for six years. Proposed Security Rule changes are proposals, not law, until a final rule is published. (45 CFR 164.404 to 164.410) | Covered entities and their business associates | PHI Protected Health Information (PHI) Individually identifiable health information protected under HIPAA: a person's health status, the care they received, or payment for that care, linked to their identity. Alerts touching systems that hold PHI raise the escalation stakes, because exposure carries regulatory breach-notification duties. plausibly accessed; impermissible access is presumed a breach unless a documented risk assessment shows otherwise | Discovery | Individuals without unreasonable delay, no later than 60 days. Media too when more than 500 residents of a state are affected. HHS at the same time for 500 or more, otherwise within 60 days of year end. A business associate notifies the covered entity within 60 days of discovery, and its agreement probably says sooner | Privacy officer |
| DFARS 252.204-7012 DFARS 252.204-7012 The US Department of Defense contract clause for safeguarding covered defense information. Cyber incidents affecting it are reported to DoD through DIBNet within 72 hours of discovery, and images of the affected systems are preserved for at least 90 days. See Notification clocks. (clause) | US defense contractors and subcontractors handling covered defense information | A cyber incident affecting a covered contractor information system or the defense information on it | Discovery | DoD through the DIBNet portal within 72 hours (a DoD-approved medium-assurance certificate is required); preserve affected images and packet captures for at least 90 days after the report | Contracts, security and legal |
| CIRCIA Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) A 2022 US law that will require covered critical-infrastructure entities to report covered cyber incidents to CISA within 72 hours of reasonably believing one occurred, and ransom payments within 24 hours of making them. The duties take effect only when CISA's final rule does, so check its current status before relying on the clocks. (CISA) | Covered critical-infrastructure entities, once the final rule takes effect | Not yet in force | Not yet in force | When effective: covered incidents to CISA within 72 hours, ransom payments within 24 hours. Today reporting is voluntary | Legal |
Status to watch. CIRCIA’s final rule went to the White House for review on October 1, 2026, after missing its October 2025 statutory deadline; check whether it has been published before relying on its clocks. SEC Item 1.05 is in force, but the SEC opened Regulation S-K to comment in January 2026 and industry groups have asked it to rescind Item 1.05; no proposal had been made as of October 2026.
US states
Law as of October 13, 2026. Every US state has a breach-notification law, and the residence of the affected people decides which ones apply, not where your company sits. The Privacy Rights Clearinghouse’s 2026 survey counts 20 states with a numeric consumer deadline, from 30 to 60 days; the rest say “without unreasonable delay”. These six show the pattern.
| State and source | Clock starts at | Individuals | State regulator |
|---|---|---|---|
| California (Civ. Code §1798.82) | Discovery or notification of the breach | Within 30 calendar days (since January 1, 2026). Delay only for law enforcement, or as needed to determine scope and restore integrity | Sample notice to the Attorney General within 15 calendar days of notifying, when more than 500 residents are notified |
| Colorado (C.R.S. 6-1-716) | Determination that a breach occurred | Within 30 days | Attorney General within 30 days when 500 or more residents are affected |
| Florida (Fla. Stat. 501.171) | Determination of a breach, or reason to believe one occurred | Within 30 days | Department of Legal Affairs within 30 days when 500 or more residents are affected |
| New York (GBL 899-aa) | Discovery | Within 30 days; delay only when law enforcement determines notice would impede a criminal investigation | Verify with counsel |
| Texas (Attorney General) | Determination that the breach occurred | Within 60 days | Attorney General within 30 days when at least 250 residents are affected, on the AG’s online form |
| Washington (RCW 19.255.010) | Discovery | Within 30 calendar days | Attorney General within 30 days when more than 500 residents are notified |
For every other state, use a maintained tracker through counsel: the Privacy Rights Clearinghouse 50-state survey (statutes as of January 1, 2026) or NCSL’s statute list. Data you hold for someone else usually puts you on a separate, faster duty to tell the data’s owner (California: immediately after discovery).
Contractual, card-brand and insurance clocks
These are not statutes, and they are often the shortest clock in the case.
| Clock | What you see | Clock starts at | First deadline | Decision owner |
|---|---|---|---|---|
| Visa (What To Do If Compromised) | Account data, or a system that stores, processes or transmits it, plausibly accessed | Reasonable suspicion of compromise | Acquirer immediately; Visa within three calendar days | Acquirer-relationship owner |
| American Express (Data Security Operating Policy) | Amex card data plausibly accessed | Discovery of a data incident | Immediately, and no later than 72 hours | Acquirer-relationship owner |
| Mastercard | Mastercard account data plausibly accessed | Verify with counsel and your acquirer | Verify with counsel and your acquirer; merchants usually notify the acquirer, which reports onward | Acquirer-relationship owner |
| Customer contracts (DPAs, MSAs) | Customer data or a customer-facing service touched | Usually your awareness or discovery, as the contract defines it | Often 24 to 72 hours; read the contract | Legal and the account owner |
| Cyber insurance | Any incident the policy covers | As the policy defines it | Prompt notice is often a coverage condition, sometimes before you engage outside IR or counsel | Legal or risk management |
Outside the EU, UK and US
Law as of October 13, 2026. Two short clocks catch multinationals most often.
| Regime and source | Who it binds | Trigger | First deadline, to whom |
|---|---|---|---|
| India: CERT-In Directions of April 28, 2022 (directions) | Service providers, intermediaries, data centres, body corporates and government organizations | A cyber incident of a listed type (including intrusions, ransomware, data breaches and leaks) | CERT-In within 6 hours of noticing it or being told about it; more detail may follow |
| Australia: Cyber Security Act 2024, Part 3 (Home Affairs factsheet) | Businesses with annual turnover above AUD 3 million, and responsible entities for critical-infrastructure assets | A ransomware or cyber-extortion payment, made by the entity or on its behalf | The Australian Signals Directorate within 72 hours of the payment, or of learning it was made |
Parallel clocks
One event can start several clocks, each with its own start, deadline and owner. They run at the same time, not in sequence, and none of them waits for the investigation to finish. The SOC does not track the clocks; it keeps the timestamp record every clock owner will draw on.
Case A, the finance-team intrusion, shows the pattern. At 09:42 UTC the analyst recognizes that the compromised user can reach a cloud finance reporting platform holding personal data of vendor contacts in the EU and possibly card data. At 09:45, compliance and the DPO are in the case.
| Candidate clock | What the analyst recorded | Who decides and tracks it |
|---|---|---|
| GDPR Art. 33 (72 hours from awareness) | 09:42: personal data of vendor contacts in the EU in reach; no platform activity seen yet | DPO. Reach alone is not awareness; a later finding of attacker activity on the platform may be |
| Card-brand rules (from suspicion) | 09:42: card data in reach if the platform touches it; compliance owns that question | Acquirer-relationship owner |
| SEC 8-K Item 1.05 (if the company is listed) | Business functions affected and when each fact was established | Disclosure committee, through counsel |
| Customer and vendor contracts | Which customers’ or vendors’ data the platform holds | Legal and the account owners |
Three rules keep parallel clocks from colliding.
- The shortest clock sets the pace. If any candidate clock is measured in hours (CERT-In, DORA, NIS2, NYDFS’s ransom notice, a 24-hour contract), every owner is engaged in that window, not only the one whose clock it is.
- One timestamp record, many readers. Record each candidate start once, in UTC, with what you knew at that moment. Each owner reads the same record and decides which moment counts for their regime.
- Each clock has one named owner. The handoff packet carries the flags and the owners engaged, so incident response inherits the clocks with the case and nobody assumes someone else filed.
Special cases
Law-enforcement delay requests
Several regimes let law enforcement delay notice to individuals: California, New York and Washington state law, HIPAA (§164.412), and the US banking agencies’ guidance (a written request). SEC Item 1.05 has its own route through the US Attorney General. Do not assume a delay exists elsewhere, and never act on one yourself: a delay request goes to counsel, who confirms it, records it and tells each clock owner. If a caller asks you to hold off on visible containment, that is a decision for counsel and the IR lead (see special routes).
Ransom and extortion payments
A payment starts its own clocks: NYDFS 500.17 (24 hours, then a 30-day written explanation), Australia’s Part 3 report (72 hours), and CIRCIA once its rule takes effect (24 hours). Payment decisions belong to legal, executives and the insurer, with sanctions screening against Treasury’s OFAC lists (see external parties). The analyst’s part is to record when the demand arrived, when IR and legal were told, and to preserve the demand and its channel as evidence. The SOC never talks to the threat actor.
Child sexual abuse material
Stop. Do not view it further, copy, download or forward it, even to a colleague or into the case. Record only the metadata the tooling already shows (location, hash, time), and route it to counsel and the organization’s legal reporting channel. In the US, providers of electronic communication or remote computing services must report apparent child sexual abuse material to NCMEC’s CyberTipline (18 U.S.C. §2258A), and the report is treated as a request to preserve for one year. Counsel decides whether that duty applies to you. The analyst is rotated off the case and offered support (see cognitive traps).
The regulatory flags block
This page feeds one field, the regulatory flags block Regulatory Flags BlockASSURED term In ASSURED, the template block on the event report and handoff packet that records, when regulated data is plausibly involved, the regime, the data class, the candidate clock start in UTC, the owner engaged and the owner's decision. Triage flags; privacy and legal decide. See The regulatory flags block. . The event report and the handoff packet carry the same block, so the flags travel with the case. Under the table, three lines carry what the owner needs before deciding on notice: the estimated affected individuals and their jurisdictions; the preservation or legal-hold status and its scope; and counsel’s handling instructions for the record (labeling, channel, distribution). Write “unknown” or “none yet” rather than leaving a line blank.
### Regulatory flags (optional, when regulated data is plausibly involved)
<!-- Each regulatory or contractual clock that may apply. Triage records the
candidate start; the regime's owner decides whether the clock started. -->
| Regime | Data class and trigger observed | Candidate awareness or trigger timestamp (UTC) | Owner engaged (who), at (UTC) | Owner's decision |
| --- | --- | --- | --- | --- |
| | | | | |
- Estimated affected individuals and their jurisdictions (if known):
- Preservation or legal-hold status and scope (who authorized it, and when, UTC):
- Counsel handling instructions (labeling, channel, distribution), if any:The block, filled in for Case A at the end of Scope
| Regime | Data class and trigger observed | Candidate awareness or trigger timestamp (UTC) | Owner engaged (who), at (UTC) | Owner’s decision |
|---|---|---|---|---|
| GDPR Art. 33 | Personal data of vendor contacts in the EU on the cloud finance reporting platform. Reach only: no platform activity seen | 09:42 (regulated data recognized in reach) | DPO, 09:45 | Pending; DPO to reassess on any platform finding |
| Card-brand rules (PCI DSS) | Card data, if the platform touches it (unconfirmed) | 09:42 | Compliance (acquirer-relationship owner), 09:45 | Pending: compliance confirming whether the platform is in PCI scope |
- Estimated affected individuals and their jurisdictions: unknown; no platform record has been seen accessed. EU vendor contacts are in reach.
- Preservation or legal-hold status and scope: technical preservation only (the script and its hash, the RunMRU export, proxy-log cleanup paused, platform audit logs held past rotation). No legal hold yet; whether one is needed is counsel’s call.
- Counsel handling instructions: none yet.
A documented “none” belongs in the record too. Case B records “no regulated data in reach; source code is sensitive but not regulated”, which is a regulatory boundary as real as Case A’s.
Sources
All checked October 13, 2026.
- EU: GDPR, Regulation (EU) 2016/679, Art. 33 and 34, with EDPB Guidelines 9/2022 on awareness. NIS2, Directive (EU) 2022/2555, Art. 23. DORA, Regulation (EU) 2022/2554, Art. 19, and Delegated Regulation (EU) 2025/301, Art. 5. Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 14, and ENISA’s Single Reporting Platform FAQ (operational September 11, 2026).
- UK: UK GDPR Art. 33 and the ICO’s breach-reporting guidance. NIS Regulations 2018, reg. 11.
- US federal: SEC Item 1.05 adopting release (July 2023) and Regulation S-P compliance guide. FTC Safeguards Rule, 16 CFR 314.2 and 314.4(j). Banking, 12 CFR 53.3 and 53.4, and the interagency response-program guidance. 23 NYCRR 500.17. HIPAA, 45 CFR 164.406, 164.408 and 164.410. DFARS 252.204-7012. CISA’s CIRCIA page. 18 U.S.C. §2258A.
- US states: the statutes linked in the state table, and the Texas Attorney General’s data breach reporting page.
- Card brands: Visa, What To Do If Compromised (Version 10.0). American Express, Data Security Operating Policy, Section 3. Mastercard’s current Security Rules and Procedures could not be retrieved, so its row says “verify”.
- Elsewhere: CERT-In Directions No. 20(3)/2022. Australia, Department of Home Affairs ransomware payment reporting factsheet.
Key takeaway
Recognize, flag, route. Match what the case shows against the table, record each candidate start in UTC with what you knew at the time, and get every owner in within the window of the shortest clock. Clocks start at awareness, discovery, suspicion, a determination, or a payment, and several of them run in hours. Notification is decided by privacy, legal and compliance; the speed at which they hear about it is decided in triage.
Next up
Time boundaries
Historical review windows, real-time investigation, retention limits. When the investigation starts and stops.
Read time boundariesTechnical details verified . Product names, defaults and retention change; check your own tenant.