Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →There is no single data-breach notification deadline or universal notice template. A company must first identify the jurisdictions, type of organization, information involved, number of people affected, and the law’s definition of a reportable breach. It may then owe separate notices to a regulator, affected individuals, the media, customers or business partners, and law enforcement. The required timing and wording can differ for each recipient.
This guide explains the notification process and the information commonly required under the EU General Data Protection Regulation (GDPR), the U.S. Federal Trade Commission (FTC) Health Breach Notification Rule, the FTC Safeguards Rule, U.S. state laws, and the United Kingdom’s Data Protection Act 2018 Part 3.
As an Amazon Associate I earn from qualifying purchases.
Start with scope: which law applies?
A breach investigation begins with legal scope, not with drafting a customer email. The organization should establish:
- Which entity owns, controls, stores, or processes the information.
- Where affected people live and where the organization operates.
- Whether the organization is a controller, processor, covered health-record business, financial institution, government body, or another regulated entity.
- What information was accessed, acquired, disclosed, altered, or lost, and whether it was encrypted or otherwise made unintelligible.
- How many people and records may be affected.
- When the organization became aware of the incident or discovered the qualifying event.
- Whether the event meets the applicable law’s breach definition and risk threshold.
All U.S. states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have breach-notification laws, but their definitions, deadlines, required wording, and exceptions differ. Federal rules can apply at the same time. A notice that satisfies one law may not satisfy another.
#1 Best Overall
Who may need to be notified?
Affected individuals
Consumer or employee notice is generally intended to let people protect themselves. Depending on the law, the company may need to notify every affected person, only people facing a specified level of risk, or people in a particular jurisdiction. Notice may be sent by mail, email, telephone, or another permitted method. If contact information is inadequate, a law may allow substitute notice, such as a conspicuous website posting or media announcement.
Supervisory authorities and other regulators
Regulator notice is a separate duty. Under GDPR Article 33, a controller reports a qualifying personal-data breach to the competent supervisory authority. The FTC Health Breach Notification Rule can require notice to the FTC, while the FTC Safeguards Rule requires a covered financial institution to report certain events to the FTC. Filing a regulator report does not automatically replace individual notice.
Media
Some laws require prominent media notice when a large number of residents in a state, district, or territory are affected. Under the FTC Health Breach Notification Rule, media notice is required when at least 500 residents of one state, the District of Columbia, or a U.S. territory or possession are affected.
Processors, customers, and business partners
A service provider may have to alert the organization that controls the data. Contracts can also require notice to customers, insurers, payment networks, or other partners even when a statute does not. These contractual notifications do not eliminate statutory duties to regulators or individuals.
Law enforcement
Investigators may ask a company to delay public notice when immediate disclosure could impede an investigation. The company should coordinate timing with the relevant law-enforcement agency and document the request and the reason for any delay. A delay permitted for an investigation is not a permanent exemption from notification.
How deadlines are calculated
Deadlines usually run from a defined awareness or discovery point, not from the moment an incident first began. Keep a written timeline showing when suspicious activity was identified, when the organization confirmed a personal-data breach or notification event, what facts were known at each stage, and when each notice was sent.
| Regime | Trigger and timing | Recipients | Important qualifications |
|---|---|---|---|
| GDPR Article 33 | Without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of a personal-data breach. | Competent supervisory authority | No authority notice is required when the breach is unlikely to result in a risk to people’s rights and freedoms. A late notice must explain the delay. |
| GDPR Article 34 | Without undue delay when the breach is likely to result in a high risk to people’s rights and freedoms. | Affected individuals | Exceptions can apply when protective measures made the data unintelligible, later measures removed the high risk, or individual contact would involve disproportionate effort. |
| FTC Health Breach Notification Rule | Individuals: without unreasonable delay and within 60 calendar days after discovery. FTC and, where applicable, media deadlines depend on the number affected. | Affected U.S. citizens or residents, the FTC, and sometimes media | For 500 or more people, FTC notice is due at the same time as individual notices. For fewer than 500, FTC notice is due within 60 calendar days after the end of the calendar year. Media notice applies at 500 or more residents of one state, DC, or territory. |
| FTC Safeguards Rule | As soon as possible and no later than 30 days after discovery of a qualifying notification event. | FTC | Applies to covered financial institutions when unauthorized acquisition involves at least 500 consumers’ unencrypted information. Information encrypted with a key accessed by an unauthorized person is treated as unencrypted for this purpose. |
| UK Data Protection Act 2018, Part 3 | Section 67 requires notification to the Commissioner for a Part 3 personal-data breach; if notification is not made within 72 hours, reasons for delay must accompany it. | Commissioner | Part 3 concerns law-enforcement processing. It is not a universal 72-hour rule for every UK controller or processing context. |
What a GDPR notification must contain
Notice to the supervisory authority: Article 33
GDPR Article 33 requires the controller’s notification to include, at minimum:
- The nature of the breach. Explain what happened, such as unauthorized access, disclosure, loss, alteration, or destruction. Where possible, state the categories and approximate number of affected data subjects and personal-data records.
- A contact point. Give the data protection officer’s name and contact details, or the details of another person who can answer the authority’s questions.
- Likely consequences. Describe reasonably foreseeable effects on individuals, such as identity fraud, financial loss, discrimination, or exposure of sensitive information, without overstating facts that remain unconfirmed.
- Response and mitigation. Describe measures already taken or proposed to address the breach and reduce its adverse effects.
The controller can provide information in phases when every fact is not available at once, but later information must be supplied without undue further delay. If the 72-hour period is missed, the notice must state why.
Rank #3
Communication to individuals: Article 34
When a breach is likely to create a high risk to individuals’ rights and freedoms, the controller must communicate it to affected people without undue delay, using clear and plain language. The communication must include the information and measures identified in Article 33(3)(b)–(d): a contact point, likely consequences, and the steps taken or proposed to address and mitigate the breach.
Individual communication is not required in every case. Article 34 lists exceptions, including situations where effective technical and organizational safeguards made the data unintelligible to unauthorized people, subsequent measures mean the high risk is no longer likely to materialize, or individual communication would require disproportionate effort. In the last situation, a public communication or similar measure must still make the information available in an equally effective way.
FTC Health Breach Notification Rule
Who is covered
The rule covers vendors of personal health records, personal-health-record-related entities, and their third-party service providers as described by the rule. It does not impose a general 60-day deadline on every company that holds health information. Coverage must be checked against the organization’s role and the rule’s definitions.
Recommended Free Tools
Recipients and timing
A covered entity must notify each affected U.S. citizen or resident and the FTC. In some circumstances it must also notify prominent media serving the affected area.
- Individuals: notify without unreasonable delay and within 60 calendar days after discovery.
- 500 or more affected people: send the FTC notice at the same time as the individual notices.
- Fewer than 500 affected people: send the FTC notice within 60 calendar days after the end of the calendar year in which the breaches were discovered.
- 500 or more residents of one state, DC, or a U.S. territory or possession: provide prominent media notice without unreasonable delay and within 60 calendar days.
The “without unreasonable delay” requirement means a company should not wait until day 60 if it has gathered the information needed for an accurate notice earlier.
Required individual-notice information
An individual notice should be clear and conspicuous and include:
- A brief description of what happened.
- The dates of the breach and discovery, if known.
- The identity or description of third parties that acquired the information, if known.
- The types of identifiable health information involved.
- Steps taken to investigate, mitigate harm, and protect against future breaches.
- Any support the company is actually offering.
- At least two ways for recipients to contact the company.
If contact details are inadequate, the rule’s substitute-notice options may be available. The company should not promise credit monitoring, identity-theft assistance, or another benefit unless it is genuinely providing that support and can explain how to obtain it.
Free tools Windows power users keep installed
One-click scans. No signup required.
FTC Safeguards Rule reporting
The Safeguards Rule creates a separate FTC reporting duty for covered financial institutions. A reportable notification event involves unauthorized acquisition of unencrypted information belonging to at least 500 consumers. If an unauthorized person obtains the key needed to decrypt data, the information is treated as unencrypted for this rule.
Best Value
The institution must report as soon as possible and no later than 30 days after discovery. The FTC report requests high-level facts, including:
- The company’s name.
- The event’s dates.
- The number of affected or potentially affected consumers.
- The types of information involved.
- A brief summary of the incident.
If some details are unknown, the institution should submit what it knows and update the report when more information becomes available. Reports may be public, so the filing should be accurate, concise, and free of speculation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What state breach notices commonly disclose
State statutes often specify information that must appear in a notice and information that must not appear. Requirements can include the nature of the incident, the categories of personal information, approximate dates, steps the organization has taken, recommended protective actions, and contact details for questions. Some statutes regulate the format, delivery method, substitute notice, or timing of notice to a state attorney general.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBecause state rules differ, a company should map each affected person to the law of the relevant jurisdiction rather than send one national template by default. A notice can be written in plain language while still using jurisdiction-specific disclosures. Misleading statements, unexplained omissions, or assurances that exceed the known facts can undermine compliance and consumer protection.
Build an accurate breach notification: a practical sequence
- Preserve evidence and establish the clock. Secure logs, systems, forensic records, and communications. Record the exact date and time of awareness or discovery used by each applicable rule.
- Map affected people and laws. List residences, organization type, data categories, encryption status, record counts, and contractual obligations. Identify overlapping state, federal, sector-specific, and international regimes.
- Separate recipients. Create distinct workstreams for regulators, individuals, media, customers, processors, and law enforcement. Do not assume one filing covers all of them.
- Assess risk and exceptions. Determine whether the law uses a risk threshold, a high-risk test, a minimum number of people, an acquisition standard, or an encryption exception. Document the reasoning even when the conclusion is that notice is not required.
- Draft only confirmed facts. State what happened, when it happened and was discovered, what information was involved, who may be affected, and what remains under investigation. Use qualified wording for estimates and update later when facts change.
- Give actionable advice. Tell recipients what steps fit the exposed information, such as changing a reused password, watching account statements, replacing compromised credentials, or contacting a dedicated help line. Offer support only when the organization has arranged it.
- Coordinate timing. Consult law enforcement if early disclosure could interfere with an investigation. Check regulator instructions, language requirements, media thresholds, and any permitted delay before sending.
- Maintain a notice record. Keep copies of final notices, delivery dates, recipient lists, regulator submissions, updates, questions received, and remediation decisions.
Common mistakes and how to avoid them
- Treating 72 hours, 60 days, or 30 days as universal: each figure belongs to a specific rule, trigger, covered entity, and recipient.
- Using one notice for every audience: a regulator needs structured incident facts, while an individual needs understandable risk information and practical steps.
- Waiting for a perfect investigation: GDPR permits phased information, and other regimes may require prompt notice. Send an accurate initial notice and update it when necessary.
- Confusing health-data possession with FTC Health Breach Notification Rule coverage: verify that the organization is a covered personal-health-record business or related entity.
- Ignoring encryption details: encryption can affect risk and exceptions, but the Safeguards Rule treats data as unencrypted when an unauthorized person accesses the decryption key.
- Promising benefits that are not ready: do not advertise credit monitoring, identity-theft support, or reimbursement unless the company has actually arranged the service and can explain eligibility.
- Publishing sensitive details: transparency should not reveal credentials, security weaknesses, or information that creates additional risk.
- Forgetting processors and contracts: a processor may have an immediate contractual duty to alert the controller even when statutory notice is assessed separately.
What recipients should look for in a legitimate notice
A useful notice identifies the organization, describes the incident in understandable terms, states the relevant dates when known, names the categories of information involved, explains what the organization has done, and provides a working contact route. It should distinguish confirmed facts from estimates and tell recipients what protective action is appropriate. Be cautious of messages demanding payment, passwords, or one-time codes; verify contact details through an independently known company channel rather than replying to an unexpected email.
For an active incident, the organization should check the current text and instructions of every applicable regulator and obtain legal advice based on the actual facts. This article explains the major frameworks but cannot determine whether a particular event is legally reportable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
