When must you notify after a breach?
Pick the jurisdictions you operate in and an incident time. This shows each regime's notification clock, who to notify, and a computed deadline where the clock is fixed. During a real incident, minutes matter — know the clocks before you're in one.
72 hours to the DPA; to individuals “without undue delay” if high risk
Notify: Supervisory authority (DPA); affected individuals if high risk
GDPR Articles 33 & 34
4 business days after determining the incident is material
Notify: SEC (public filing)
SEC Cybersecurity Disclosure Rules (2023), 8-K Item 1.05
Not legal advice. These are simplified summaries of complex regulations with many conditions, thresholds, and exceptions. The clock trigger (e.g. “awareness” vs “materiality determination”) is often contested. Always confirm exact obligations with qualified legal counsel.
Loading…
Sample report · illustrative data
Sample result: breach notification deadlines
Example run with two regimes selected (European Union and United States public companies) and an invented trigger time of Tuesday 10 March 2026, 09:00 UTC.
Deadlines
| Regime | Notify | Clock | Computed deadline |
|---|---|---|---|
| European Union, GDPR Art. 33/34 | Supervisory authority; affected individuals if high risk | 72 hours to the authority, from becoming aware of the personal-data breach | Fri 13 Mar 2026, 09:00 UTC |
| United States (public companies), SEC Form 8-K Item 1.05 | SEC (public filing) | 4 business days after determining the incident is material | Mon 16 Mar 2026, 09:00 UTC |
Reading the result
The clock start differs by regime: awareness of the breach for GDPR, the materiality determination for the SEC filing. Regimes without a fixed hour count show the rule in words only. These are simplified summaries, not legal advice.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.