Section: Data breaches · Last updated: October 26, 2026
This guide is based on Articles 33 and 34 of the EU General Data Protection Regulation, Form 8-K Item 1.05 and General Instruction B.1 as adopted in the SEC’s 2023 cybersecurity disclosure rule (88 FR 51896, August 4, 2023), and the HIPAA Breach Notification Rule at 45 CFR 164.404 to 164.412 in the Electronic Code of Federal Regulations. It is general information, not legal advice.
“72 hours”, “four business days” and “60 days” are often quoted side by side as breach deadlines. They are not the same kind of deadline. Each rule sends the notice to a different audience, and each starts the clock at a different moment. Reading them as one countdown from the day an attack happens leads to mistakes in both directions.
1. The three rules side by side
| Question | GDPR Art. 33 | SEC Form 8-K Item 1.05 | HIPAA 164.404 |
|---|---|---|---|
| Who must report | The controller of the personal data | A company that files reports with the SEC (registrant) | A HIPAA covered entity, for breaches of unsecured protected health information |
| Who receives it | The supervisory authority | Investors, through a public filing | Each affected individual |
| Deadline | Without undue delay and, where feasible, not later than 72 hours | Within four business days | Without unreasonable delay and no later than 60 calendar days |
| When the clock starts | After the controller becomes aware of the breach | After the company determines the incident is material | After discovery of the breach |
| When no report is needed | The breach is unlikely to result in a risk to people’s rights and freedoms | The incident is not determined to be material | The organisation shows a low probability that the health information was compromised, based on a risk assessment (164.402) |
| Allowed delay | A late notice must give the reasons for the delay | U.S. Attorney General request on national security or public safety grounds | Law enforcement statement under 164.412 |
The clock-start row is where most confusion begins. The GDPR counts from awareness of the breach. HIPAA counts from discovery. The SEC counts from a decision the company itself makes about materiality, which may come days after the incident is found.
2. GDPR: 72 hours to the regulator, then people if the risk is high
- Regulator notice (Art. 33). The controller notifies the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. If the notice comes later, it must be accompanied by reasons for the delay.
- Processors. A processor that handles data for someone else notifies the controller without undue delay after becoming aware of a breach.
- Information in phases. Where it is not possible to give everything at the same time, the information may be provided in phases without undue further delay.
- Internal record. Every breach is documented, including its facts, effects and the remedial action taken, so the authority can verify compliance.
- Notice to individuals (Art. 34). When a breach is likely to result in a high risk, the controller also tells the data subjects without undue delay, in clear and plain language.
Article 34 does not require the notice to individuals if the data was protected by measures such as encryption that make it unintelligible to anyone not authorised to see it, if later measures mean the high risk is no longer likely to materialise, or if it would involve disproportionate effort. In the last case a public communication or a similar measure is used instead. The supervisory authority can also require the controller to notify people.
3. SEC: four business days after deciding the incident is material
Under General Instruction B.1 of Form 8-K, a report under Item 1.05 is filed within four business days after the company determines that it has experienced a material cybersecurity incident. Instruction 1 to the item adds that this materiality determination must be made “without unreasonable delay after discovery of the incident”.
| Point | What Item 1.05 says |
|---|---|
| Content | The material aspects of the nature, scope and timing of the incident, and its material or reasonably likely material impact, including on financial condition and results of operations |
| Missing details | State that the information is not yet available, then file an amendment within four business days after it is determined or becomes available |
| Technical detail | Not required in a level of detail that would impede the response or remediation |
| Attorney General delay | Up to 30 days, a further 30 days, and in extraordinary circumstances a final 60 days, each on a written determination; beyond that, only by SEC exemptive order |
| Telecom carriers | A carrier delaying under the FCC’s 47 CFR 64.2011 may delay for that period, and never more than seven business days after the notice required there |
| Format | Tagged as an Interactive Data File (Inline XBRL) |
The SEC’s adopting release set the start dates: companies other than smaller reporting companies began complying with Item 1.05 on December 18, 2023, and smaller reporting companies on June 15, 2024. The Item 1.05 filing is a disclosure to investors; it is separate from any notice a company may owe to customers under other laws.
4. HIPAA: 60 days, and three audiences
| Recipient | When | Section |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 calendar days after discovery | 164.404 |
| Prominent media outlets | Same 60-day limit, when more than 500 residents of a State or jurisdiction are involved | 164.406 |
| HHS Secretary, 500 or more people | At the same time as the notice to individuals | 164.408 |
| HHS Secretary, fewer than 500 people | Kept in a log and reported no later than 60 days after the end of each calendar year | 164.408 |
| Business associate to covered entity | Without unreasonable delay, no later than 60 calendar days after discovery | 164.410 |
“Discovery” has a specific meaning in 164.404(a)(2): a breach counts as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to the organisation. So if reasonable diligence would have revealed the breach earlier, the clock runs from that earlier day.
The 60 days are an outer limit, not a target. The rule says “without unreasonable delay” first. Under 164.412, a law enforcement official can ask for a delay if notice would impede a criminal investigation: with a written statement, for the period it specifies; with an oral statement, for no longer than 30 days unless a written statement follows.
5. When more than one rule applies
When one organisation is subject to more than one of these rules, the deadlines run in parallel, each from its own starting point:
- Record the moment of awareness or discovery. That date is the starting point for the GDPR 72 hours and the HIPAA 60 days.
- Record the materiality decision separately. The SEC’s four business days start from that decision, which must itself be made without unreasonable delay.
- Do not wait for complete facts. The GDPR allows information in phases, and Item 1.05 allows an amendment for details not yet known.
Many U.S. states and other countries have their own breach notice laws with different deadlines. This guide covers only the three rules named above.
FAQ
Q. Are the GDPR’s 72 hours business hours?
Article 33 says “72 hours” and does not limit it to working hours. It is also qualified by “where feasible”, and a later notice must explain the reasons for the delay.
Q. Does the SEC rule make companies notify affected customers?
No. Item 1.05 is a disclosure in a public filing for investors. Notices to customers come from other laws, such as state breach notification statutes or HIPAA.
Q. Can a HIPAA covered entity always take the full 60 days?
No. The standard is “without unreasonable delay”, and 60 calendar days after discovery is the latest permitted date, not a default waiting period.
Q. If stolen data was encrypted, do people still need to be told under the GDPR?
Article 34(3) removes the duty to notify individuals when appropriate protection, such as encryption, made the data unintelligible to unauthorised persons. The regulator notice under Article 33 is a separate question that turns on whether the breach is likely to result in a risk.
Official sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 33 and 34
- Federal Register, 88 FR 51896 (August 4, 2023) — Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, including Form 8-K General Instruction B.1 and Item 1.05
- Electronic Code of Federal Regulations (ecfr.gov) — 45 CFR 164.404, 164.406, 164.408, 164.410 and 164.412
This article is general information and not legal advice. Whether a rule applies, and when its clock starts, depends on the facts of each incident; check the current text of each regulation and the guidance of the relevant authority.