A data breach notice tells you that an organization believes your personal information was involved, or may have been involved, in a security incident. It does not by itself prove that someone stole your identity. What a company must tell you—and how soon—depends on the law that applies: the EU’s GDPR and California law, for example, use different triggers and disclosure rules.
What a data breach notice tells you
The notice is a communication about a security incident involving personal information. It should explain what happened and identify the types of information that may have been affected. A notice may concern information the organization believes was involved; receiving one does not, by itself, establish that anyone misused it.
As an Amazon Associate I earn from qualifying purchases.
Read the notice for the organization’s account of the incident, the information categories involved, what it has done or plans to do, and how to contact it for more information. The level of risk can vary with the information and circumstances; a notice alone does not establish that every recipient faces the same risk.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What companies must disclose depends on the applicable law
There is no single worldwide notice checklist or deadline. The rules below are examples for two jurisdictions, not a summary of every country, U.S. state, or industry-specific requirement.
#1 Best Overall
| Question | EU GDPR | California business notices |
|---|---|---|
| When must affected people be notified? | When the breach is likely to result in a high risk to people’s rights and freedoms. The communication must be made “without undue delay.” GDPR Article 34 | A covered business must notify a California resident when qualifying personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person. The statute also addresses encrypted information when a key or credential may make it readable or usable. California Civil Code §1798.82 |
| What is the timing rule? | “Without undue delay” for the individual communication under Article 34. GDPR Article 34 | The statute requires disclosure following discovery or notification, subject to its rules, including provisions for delay. The content rules do not establish one universal numerical deadline. California Civil Code §1798.82 |
| What must the notice say? | The nature of the breach in “clear and plain language,” a contact point, likely consequences, and measures taken or proposed. GDPR Article 34 | Plain language; the business’s name and contact information; the types of personal information involved; specified breach and notice dates when determinable; and, when determinable, whether notice was delayed because of a law-enforcement investigation. The 2025 text also prescribes the title “Notice of Data Breach” and required headings. California Civil Code §1798.82 |
| Is there a separate regulator report? | Yes. Article 33 generally requires notice to the supervisory authority within 72 hours where feasible, unless the breach is unlikely to create a risk to people’s rights and freedoms. That is separate from the higher-risk threshold for telling affected people under Article 34. GDPR Articles 33–34 | The California Attorney General says a sample notice must be submitted when a covered entity sends notice to more than 500 California residents. California Attorney General reporting guidance |
What a GDPR notice to an individual must include
Under GDPR Article 34, an organization communicates directly with affected people when a personal data breach is likely to result in a high risk to their rights and freedoms. The communication must be made “without undue delay,” and Article 34(2) requires “clear and plain language.”
- The nature of the personal data breach.
- The name and contact details of a data protection officer or another contact point.
- The likely consequences of the breach.
- The measures taken or proposed to address it, including measures to mitigate possible adverse effects.
Article 34 includes exceptions. For example, individual communication may not be required if protective measures made the affected data unintelligible to people who were not authorized to access it. The precise rule and exceptions appear in GDPR Article 34.
Rank #2
What a California business notice must include
California Civil Code §1798.82 applies to covered business notices to California residents. The statute’s 2025 text calls for a notice in plain language, titled “Notice of Data Breach,” with specified headings. It identifies content including:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- The name and contact information of the reporting person or business.
- The types of personal information involved.
- The breach date or estimated date range, when determinable, and the notice date.
- Whether notification was delayed because of a law-enforcement investigation, when determinable.
The statute also sets out the circumstances in which notice is required, including the treatment of encrypted information if a key or credential could make it readable or usable. The linked text is a third-party reproduction of the 2025 California code, so consult the applicable law for legal reliance: California Civil Code §1798.82.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A notice to people is not the same as a report to a regulator
The recipients and thresholds differ. Under GDPR Article 33, the controller generally notifies the relevant supervisory authority within 72 hours of becoming aware of a personal data breach where feasible, unless the breach is unlikely to result in a risk to people’s rights and freedoms. Article 34 separately addresses communication to affected people, and uses a high-risk threshold. A regulator report is therefore not the same communication as an individual notice. See GDPR Articles 33–34.
In California, the Attorney General’s reporting guidance says a sample notice must be submitted when a covered entity notifies more than 500 California residents. This requirement is about submitting a sample notice to the Attorney General; it is distinct from the business’s communication to affected residents. See the California Attorney General’s reporting guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
