Most markets now require a personal data breach to be reported to the regulator within days, and to affected individuals where the risk is high. The EU, Saudi Arabia and India (from May 2027) work to 72 hours; Singapore allows 3 calendar days after a breach is assessed as notifiable; the US relies on state laws and, for listed companies, SEC disclosure. A single incident can therefore trigger several clocks at once.
Clocks to the regulator
Under the GDPR a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Saudi Arabia's PDPL Implementing Regulations also set 72 hours for notifying SDAIA where harm is likely. India's DPDP Rules require an initial description to the Data Protection Board followed by a detailed report within 72 hours, from 13 May 2027. The UAE federal PDPL defers the period to executive regulations not confirmed as issued.
Singapore requires notification to the PDPC as soon as practicable and no later than 3 calendar days after the organisation assesses a breach as notifiable, which includes any breach affecting 500 or more individuals or likely to cause significant harm.1234567
Telling individuals and markets
Where a breach poses a high risk, the GDPR also requires affected people to be told. In the United States, all 50 states, the District of Columbia and the territories have notification laws, with differing definitions and deadlines, and SEC registrants must disclose a material cybersecurity incident within four business days of determining materiality.
The Commission's Digital Omnibus proposes a single EU entry point for reporting incidents and breaches, which would ease parallel reporting under different laws; it was not confirmed as adopted.891011
| Market | Trigger | Deadline | Source |
|---|---|---|---|
| EU (France, Germany) | Breach likely to result in risk | Without undue delay, within 72 hours where feasible | GDPR (EUR-Lex) |
| Saudi Arabia | Breach that may cause harm | 72 hours to SDAIA | Secondary source |
| India (from 13 May 2027) | Any personal data breach | Initial report, then detailed report within 72 hours | Secondary source on DPDP Rules |
| Singapore | Significant harm or 500 or more individuals | 3 calendar days after assessment | PDPC; Regulations |
| United Arab Emirates (federal) | Breach | Period set by executive regulations (not confirmed) | UAE Legislation |
| United States | State law definitions; SEC materiality | Varies by state; 4 business days for SEC Form 8-K | NCSL; SEC |
Decisions to make
- Which regulators would we have to notify for a breach of our main customer database?137Deadlines run in parallel and start from different trigger points.
- Who in the group decides whether a breach is notifiable, and how fast?71Singapore's 3-day clock starts on assessment; the GDPR clock starts on awareness.
- Are we an SEC registrant?10Material incidents must be disclosed within four business days of the materiality determination.
Documents usually needed
- Incident response plan with a notification matrix by country
- Breach log recording all breaches, including those not notified
- Template notices to regulators and individuals
- Processor contract clauses requiring prompt notice to the controller
- Materiality assessment procedure for listed companies
Common mistakes
- Waiting for a full investigation before the first notification
- Notifying only the regulator in the country where the breach occurred
- Not logging breaches that were judged not notifiable
- Letting processors decide when to tell the controller
- Assuming one US federal rule covers individual notification
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- The UK breach notification rule was not confirmed on an ICO page opened.
- Saudi, Indian and Singapore deadline details rest partly on secondary summaries.
- The UAE federal PDPL notification period depends on executive regulations not confirmed as issued.
- Individual US state deadlines were not compared.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Under the GDPR a controller should notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Applies to the Czech Republic as an EU member state.
Confirmed from Recital 85; the operative provision is Article 33(1), which was not reached in the fetched text. Reused from market guide claim cz-data-001.
Under the PDPL Implementing Regulations, a controller must notify SDAIA within 72 hours of becoming aware of a personal data breach that may cause harm to personal data or the data subject, and must inform affected data subjects without undue delay. Current threshold is likely harm. A draft amendment published for consultation in October 2026 would remove the harm threshold for notification to SDAIA (see sa-data-012).
Secondary source: the official Implementing Regulations page on SDAIA's platform could not yet be checked run. Reused from market guide claim sa-data-005.
The DPDP Rules require a Data Fiduciary to give the Board an initial description of a breach followed by a detailed report within 72 hours. Breach rules commence on 13 May 2027; the 72-hour period may be extended on written request according to secondary commentary.
Secondary source; the official PIB backgrounder mentions notice to individuals 'without delay' but not the 72-hour report. Confirm against the Gazette text of the Rules. Reused from market guide claim in-data-006.
Under the PDPL a controller must notify the Data Office of a personal data breach within the period set by the executive regulations, and a processor must inform the controller as soon as it becomes aware of a breach. Federal PDPL. The notification period depends on executive regulations not confirmed as issued.
Reused from market guide claim ae-data-004.
An organisation must assess a data breach and notify the PDPC, and where relevant affected individuals, if the breach is likely to result in significant harm to individuals or is of significant scale. Affected individuals are notified where significant harm is likely; exceptions apply.
Effective date from PDPC announcement that the amended PDPA took effect in phases from 1 February 2021. Reused from market guide claim sg-data-004.
A data breach is of significant scale, and so notifiable, if it affects 500 or more individuals. Breaches affecting fewer individuals are still notifiable if likely to cause significant harm; the same Regulations list the classes of personal data treated as causing significant harm.
Reused from market guide claim sg-data-005.
A notifiable data breach must be reported to the PDPC as soon as practicable and no later than 3 calendar days after the day the organisation assesses that the breach is notifiable. The assessment itself must be carried out reasonably and expeditiously.
Secondary source. The PDPC obligations page says only 'as soon as practicable'; the statutory text (PDPA section 26D) could not be loaded from Singapore Statutes Online. Reused from market guide claim sg-data-006.
Where a breach poses a high risk to individuals, the affected people must also be informed; the CNIL can advise whether this is needed. Applies in addition to notification to the CNIL.
Reused from market guide claim fr-data-002.
All 50 states, the District of Columbia, Guam, Puerto Rico and the US Virgin Islands have laws requiring notification of individuals when a security breach involves personal information. State and territorial laws; definitions, deadlines and regulator notice duties differ by state.
NCSL is a non-governmental organisation serving state legislatures; no single federal page lists all state breach laws. Reused from market guide claim us-data-005.
Companies registered with the US Securities and Exchange Commission must report a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining that the incident is material. Federal; SEC registrants only. Foreign private issuers report on Form 6-K. Annual disclosure of cybersecurity risk management and governance is required in Form 10-K (Regulation S-K Item 106) or Form 20-F. Delay possible where the Attorney General finds a substantial risk to national security or public safety.
Reused from market guide claim us-data-011.
The Commission's Digital Omnibus, adopted by the Commission in November 2025, proposes a single entry point for reporting all cybersecurity incidents and data breaches. EU proposal; adoption by the European Parliament and Council was not confirmed as at October 2026.
Questions on this topic
11 statements on personal data breach notification
