Free tool · Incident response · Data breach

Breach Notification Clock Calculator

The moment you become aware of a breach, several clocks start — and they do not all start at the same moment or run the same way. Enter when you became aware, tick the regimes that apply, and get one timeline: every deadline sorted by due date with a countdown, who to notify, the instrument, and what the first notice should contain. Where the law gives no fixed clock, you see the law's own words, not a made-up date.

Need only a quick look at the headline clocks? The simpler Breach Notification Deadline Calculator covers the main regimes on one screen.

No download, no card

When you became aware (date and time)A reasonable degree of certainty that personal data or systems were compromised — not the end of the investigation.Affected individuals (estimate)Used for thresholds (HHS, state attorneys general, Singapore). 0 shows every row.Date materiality was determined (SEC)Leave empty if not yet determined. The 8-K clock starts here.

Jurisdictions and obligations that apply to you

Europe

Asia-Pacific

North America

US states

Contracts and insurance

US states listed have explicit day limits. Most other states say “without unreasonable delay” — check each state where affected people live.

Notification timeline

13 obligations · 0 with a fixed deadline · times in your local time zone

Enter when you became aware to calculate the deadlines.

#1
Clock not started — starts from the time you became aware
Lead or competent supervisory authority (data protection authority)GDPR Art. 33
Without undue delay and, where feasible, not later than 72 hours after becoming aware. A later notice must give the reasons for the delay.
Applies: Not required if the breach is unlikely to result in a risk to people's rights and freedoms. Record that decision and the facts either way (Art. 33(5)).
First notice should contain
- Nature of the breach, including the categories and approximate number of people and records concerned
- Name and contact details of the data protection officer or other contact point
- Likely consequences of the breach
- Measures taken or proposed, including steps to mitigate possible adverse effects
- If you do not have everything yet, you may provide information in phases
If you are a processor, your duty is to tell the controller without undue delay (Art. 33(2)) — the controller notifies the authority.
Check with counsel¹
#2
Clock not started — starts from the time you became aware
Information Commissioner's Office (ICO)UK GDPR Art. 33
Without undue delay and, where feasible, not later than 72 hours after becoming aware. A later notice must give the reasons for the delay.
Applies: Not required if the breach is unlikely to result in a risk to people's rights and freedoms. Record the decision either way.
First notice should contain
- Nature of the breach, including the categories and approximate number of people and records concerned
- Name and contact details of the data protection officer or other contact point
- Likely consequences of the breach
- Measures taken or proposed, including steps to mitigate possible adverse effects
- If you do not have everything yet, you may provide information in phases
The UK and EU regimes are separate: a breach affecting both UK and EU residents usually needs a notice to each.
Check with counsel¹
#3
Clock not started — starts from the time you became aware
Internal: complete your assessmentPrivacy Act 1988 Part IIIC (NDB), s 26WH
Take all reasonable steps to complete a reasonable and expeditious assessment within 30 days of becoming aware of grounds to suspect an eligible data breach.
First notice should contain
- Was there unauthorised access, disclosure or loss?
- Is serious harm to any person likely?
- Has remedial action removed that likelihood?
This is the outer limit for the assessment. If you already have reasonable grounds to believe there is an eligible breach, notify as soon as practicable — do not wait for day 30.
Check with counsel¹
#4
Clock not started — starts from the date materiality was determined
SEC — public Form 8-K filingSEC Form 8-K Item 1.05
Within four business days after determining the incident is material.
First notice should contain
- Material aspects of the nature, scope and timing of the incident
- Its material impact, or reasonably likely material impact, on the company, including financial condition and results of operations
- Information not yet determined can be left out; file an amended 8-K within four business days after it becomes available
Business days here skip weekends only — US federal holidays are not accounted for, and EDGAR filing cut-off times apply. Delay is allowed only if the US Attorney General determines disclosure poses a substantial risk to national security or public safety.
Check with counsel¹
#5
Clock not started — starts from the time you became aware
Affected California residentsCal. Civ. Code § 1798.82
In the most expedient time possible and without unreasonable delay, and within 30 calendar days of discovering or being notified of the breach (law-enforcement delay allowed).
First notice should contain
- Titled "Notice of Data Breach" with the headings What Happened, What Information Was Involved, What We Are Doing, What You Can Do, For More Information
- Your contact details, the types of personal information involved, and the date or date range of the breach if known
- Credit-bureau contact details if Social Security, driver's licence or ID card numbers were exposed
The 30-day limit comes from a 2025 amendment effective 1 January 2026.
Check with counsel¹
#6
Clock not started — starts from the time you became aware
California Attorney General (sample copy of the notice)Cal. Civ. Code § 1798.82
Submit a sample copy within 15 calendar days of notifying residents.
Applies: If more than 500 California residents are notified.
Shown assuming residents are notified at the 30-day limit. Timing added by the same 2025 amendment.
Check with counsel¹
#7
Clock not started — starts from the time you became aware
Affected New York residentsN.Y. Gen. Bus. Law § 899-aa
In the most expedient time possible and without unreasonable delay, and within 30 days after discovery (law-enforcement delay allowed).
First notice should contain
- Your contact information
- Telephone numbers and websites of state and federal agencies that give identity-theft guidance
- The categories of information accessed or acquired, including which elements
Check with counsel¹
#8
No fixed date
Affected individualsGDPR Art. 34
Without undue delay.
Applies: Only where the breach is likely to result in a high risk to them. Exceptions include data that was encrypted with an uncompromised key (Art. 34(3)).
First notice should contain
- Plain-language description of the nature of the breach
- Name and contact details of the DPO or other contact point
- Likely consequences
- Measures taken or proposed, and what people can do to protect themselves
Check with counsel¹
#9
No fixed date
Affected individualsUK GDPR Art. 34
Without undue delay.
Applies: Only where the breach is likely to result in a high risk to them.
First notice should contain
- Plain-language description of the nature of the breach
- Name and contact details of the DPO or other contact point
- Likely consequences
- Measures taken or proposed, and what people can do to protect themselves
Check with counsel¹
#10
No fixed date
Office of the Australian Information Commissioner (OAIC)Privacy Act 1988 Part IIIC (NDB), s 26WK
As soon as practicable after you have reasonable grounds to believe an eligible data breach has happened.
First notice should contain
- Your identity and contact details
- A description of the breach
- The kinds of information concerned
- Recommended steps individuals should take
Check with counsel¹
#11
No fixed date
Affected individuals (all, or only those at risk) — or publish the statement if neither is practicablePrivacy Act 1988 Part IIIC (NDB), s 26WL
As soon as practicable after preparing the statement for the OAIC.
First notice should contain
- The contents of the statement given to the OAIC
Check with counsel¹
#12
No fixed date
NY Attorney General, Department of State and Division of State Police (and DFS if you are DFS-regulated)N.Y. Gen. Bus. Law § 899-aa
When residents are notified: the timing, content and distribution of the notices and the approximate number affected.
Check with counsel¹
#13
No fixed date
Cyber insurer (through your broker if the policy says so)Your policy's notice clause
As your policy requires — often "as soon as practicable". Late notice can put cover at risk. Check panel-vendor and consent rules before engaging forensics, legal or PR.
First notice should contain
- Policy number, a short description, when you became aware, and the vendors you want to engage
Check with counsel¹

Notes for the regimes you selected

EU GDPR: Proposals published by the European Commission in late 2025 would change the GDPR breach-notice threshold and deadline. Check whether any amendment is in force on your date.
Australia NDB: An eligible data breach is unauthorised access, disclosure or loss of personal information likely to result in serious harm, where remedial action has not removed that likelihood.
US SEC (listed company): The 4-business-day clock runs from the materiality determination, not from discovery. The determination itself must be made without unreasonable delay after discovery.
California: Applies by the residence of the affected person. The trigger (discovery or determination), the data elements that count as personal information, encryption safe harbours and law-enforcement delays differ by state.
New York: Applies by the residence of the affected person. The trigger (discovery or determination), the data elements that count as personal information, encryption safe harbours and law-enforcement delays differ by state.

¹ Not legal advice. These are plain-language summaries of laws with conditions, thresholds, exceptions and national variations, reviewed October 2026. When a clock starts (awareness, discovery, determination, materiality) is often a judgement call. Business days skip weekends only — public holidays are not accounted for. Day-based deadlines are shown as the end of that day in your time zone. Confirm every deadline, and whether each regime applies to you, with qualified counsel.

TL;DR

What this calculator does

Enter when you became aware, tick the regimes that apply, and get every notification deadline as a single timeline sorted by due date, with a live countdown.
Covers EU and UK GDPR, NIS2, DORA, Australia's NDB scheme, Singapore PDPA, India (CERT-In and the DPDP Rules), US SEC Form 8-K Item 1.05, HIPAA, NY DFS Part 500, Canada PIPEDA, nine US states with fixed day limits, contracts and your cyber insurer.
Each clock runs from its own trigger: awareness for GDPR and NIS2, the materiality determination for the SEC (four business days, weekends skipped), classification as major for DORA, and the notifiability assessment for Singapore.
Where a law gives no fixed clock — "as soon as practicable", "without unreasonable delay" — the tool shows that phrase instead of inventing a date.
Every row names the instrument, who to notify and what the first notice should contain. Copy, download or print the timeline for the incident log. Nothing leaves your browser.

Why the trigger matters as much as the number

Most deadline mistakes are not about the number of hours. They are about when the clock started. GDPR and NIS2 count from becoming aware. The SEC counts four business days from the materiality determination. DORA counts four hours from classifying the incident as major, with a 24-hour backstop from awareness. Singapore counts three calendar days from your assessment that the breach is notifiable. US states count from discovery or determination, depending on the statute.

Write the awareness time in the incident log the moment you have it, with the reasoning. Regulators ask, and “we were waiting for the forensic report” is rarely accepted as a reason to start late. Most regimes let you file an initial notice with what you know and update it.

Then work the timeline from the top with the Data Breach Response Checklist, and size the population with the Breach Records Scoping Estimator.

Frequently asked questions

When does the GDPR 72-hour clock start?

When the controller becomes aware of the personal data breach — a reasonable degree of certainty that a security incident has compromised personal data. It does not wait for the investigation to finish. If you are a processor, you must tell the controller without undue delay, and the controller's clock generally starts when you do. Check with counsel.

How is the SEC four-business-day deadline calculated?

Form 8-K Item 1.05 is due within four business days after the company determines a cybersecurity incident is material — not four days after discovery. The materiality determination itself must be made without unreasonable delay. This calculator counts Monday to Friday and does not skip US federal holidays, so confirm the date with counsel.

What are the NIS2 reporting deadlines?

For a significant incident: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the incident notification. The details, authority and portal come from each member state's national law.

What does DORA require for a major ICT incident?

An initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it; an intermediate report within 72 hours of the initial notification; and a final report within one month of the latest intermediate report. Use your competent authority's template.

Which US states have a fixed number of days to notify?

Many states say only "without unreasonable delay", but several set limits. This tool includes California, Colorado, Florida, Maine, New York and Washington (30 days), Vermont (45 days, with a 14-business-day preliminary notice to the attorney general), and Connecticut and Texas (60 days, with a 30-day attorney general notice in Texas when 250 or more residents are affected). Laws change — check the current statute for every state where affected people live.

Is this legal advice?

No. It is a planning aid built from plain-language summaries of complex laws, reviewed in October 2026. Thresholds, exceptions and triggers matter, and the moment a clock starts is often a judgement call. Use it to organise the conversation with counsel, not to replace it.

More free security tools

The tools people use most on PlayCISO.

All tools

Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.