Breach notification

What it means

Breach notification is a legal duty, found in many privacy and security laws, to tell a regulator, and sometimes the people affected, when personal data has been exposed. The law sets who must be told, what the notice contains and how quickly it has to go out.

The clock usually starts when you become aware of the breach, not when the investigation ends. That detail catches teams out, because the full story rarely exists in the first few days and the notice is still due. Send what you know, then update the notice as the facts become clear.

Why it matters

Late or missing notice can be penalised separately from the breach itself. Under the GDPR, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. People are told directly when the risk to them is high.

Other regimes differ. In India, the DPDP Act expects the Data Protection Board and affected people to be told, and the CERT-In directions set a six-hour window for certain incidents. US health rules and state laws add their own rules.

How it shows up

You meet it as a scramble: who decides it is a notifiable breach, who drafts the notice, who talks to the regulator and customers? The teams that cope have settled these answers in the incident response plan before anything happens, including a template and contact details.

Common mistakes are waiting for certainty before starting the clock, sending a notice that is vague about what data was involved, and forgetting your own contracts. Enterprise customers often require notice within days, and processors must tell controllers quickly. Keep a record of the breaches you decided not to report, with the reasoning.