Breach Notification

Breach notification is the legal requirement to inform regulators and affected individuals when personal data is compromised.

Breach notification requirements vary by regulation but generally mandate timely disclosure of data breaches.

Notification requirements by regulation: - GDPR: 72 hours to supervisory authority - HIPAA: 60 days to HHS and individuals - CCPA: "Reasonable" time frame - State Laws: Typically 30-60 days

Notification content typically includes: - Nature of the breach - Types of data affected - Timeline of events - Remediation steps taken - Steps individuals should take - Contact information

Who to notify: - Regulators (where required) - Affected individuals - Law enforcement (if criminal) - Cyber insurance provider - Board/executives

Why It Matters

Failure to notify regulators and affected individuals within required timeframes can multiply penalties dramatically. GDPR fines for notification failures are separate from and additional to fines for the breach itself. Organizations must have documented breach notification procedures ready before an incident occurs—scrambling to figure out requirements during a crisis leads to missed deadlines and compounded liability.

Key Points

GDPR requires 72-hour notification

Must document breach response

Content requirements are specific

Failure to notify compounds liability

Insurance often covers notification costs

Applicable Compliance Frameworks

GDPR HIPAA PCI DSS

Related Terms

Data Breach

A data breach is a security incident where protected, sensitive, or confidential data is accessed, disclosed, or stolen by unauthorized parties.

Incident Response

Incident response is a structured approach to preparing for, detecting, containing, and recovering from security incidents while minimizing damage.

GDPR

GDPR (General Data Protection Regulation) is the EU's comprehensive data privacy law that governs how organizations collect, process, and protect personal data of EU residents.