A leaked database rarely announces itself. It shows up as an odd login at 6 a.m., a call from a customer who found their own record on a forum, or a terse email from a cloud provider about a storage bucket left open to the internet. Plugging the hole might take an afternoon. Answering for it takes months, and the rules that shape that answering are the breach notification laws.
What Breach Notification Laws Actually Demand
The underlying idea is simple. Regulators cannot prevent every leak, so they require companies to confess quickly, clearly, and to the right people. That breaks down into three duties bundled together: assess the incident, notify within a deadline, and keep records proving you did both.
There is no single global standard. In the United States, every state has its own notification statute, and they differ on timing, thresholds, and who counts as an affected resident. On top of that sit sector rules such as HIPAA for health data and the Gramm-Leach-Bliley Act for financial information, plus the GDPR and UK GDPR in Europe, NIS2 for covered critical sectors, and Canada's PIPEDA. Contracts add another layer: payment card rules and enterprise customer agreements often impose tighter clocks than any law does.
The practical takeaway is that the strictest rule that applies to you usually governs. You do not get to pick the friendliest jurisdiction.
Who Has to Be Told
The people whose data was exposed
This is the core obligation in nearly every regime. Individuals must be told in plain language what happened, what categories of their information were involved, and what they can do about it. Many laws only require individual notice where there is a risk of harm, but that exception is narrower than it sounds once you are dealing with Social Security numbers, payment details, health records, or credentials. Where contact details are stale or the affected group is very large, some jurisdictions allow substitute notice through your website and the press.
Regulators and authorities
Data protection authorities in Europe, state attorneys general in the US, the Department of Health and Human Services for health breaches, and sector regulators where relevant. Several US states require attorney general notification only above certain resident counts, so the same incident can trigger different obligations in different states.
Sometimes the public
Large health breaches often require media notice. Listed companies may have to disclose material incidents in public filings. Law enforcement can sometimes ask you to hold off on notifying individuals while an investigation is active, but that delay is usually time-limited and should be documented.
How Long You Have: Timelines That Surprise People
- GDPR and UK GDPR: 72 hours to the supervisory authority after becoming aware of a breach likely to risk people's rights. Individuals must be told without undue delay where the risk is high.
- NIS2 (EU, covered sectors): an early warning within 24 hours, a fuller notification within 72 hours, and a final report later.
- HIPAA: individuals, and in large cases the media and HHS, no later than 60 days after discovery.
- US state laws: commonly 30 to 60 days from discovery, though many require notice "without unreasonable delay" regardless of the outer limit.
- Public companies in the US: material incidents disclosed on Form 8-K within four business days of the materiality determination.
- Contracts: 24 to 72 hours is common in vendor, cloud, and enterprise agreements.
Notice that most clocks start at discovery, not at confirmation. You do not need every fact before you pick up the phone, and waiting for a complete forensic picture can push you past a deadline. Investigate fast, but start the notification process in parallel.
Not Every Incident Is a Reportable Breach
Laws usually hinge on whether the exposed information is personal data and whether the incident creates a risk of harm. Two common carve-outs: data that was properly encrypted, where the key was not compromised, and access by an employee acting in good faith within their role.
Even when you conclude that notification is not required, write down the reasoning. Note who made the call, when, and on what evidence. A documented, defensible analysis is worth far more than a verbal consensus nobody can reconstruct six months later.
Documentation: The Part Nobody Thinks About Until Later
Regulators, insurers, and opposing counsel all ask the same question: can you show what you knew and when you acted? Keep a single, versioned incident file that includes:
- A timeline of detection, escalation, containment, and key decisions.
- The scope of the incident and the specific data elements involved.
- Your risk-of-harm assessment and the person who signed off on it.
- Copies of every notice sent, to whom, and on what date.
- Remediation steps taken, including credential resets and monitoring.
- Communications with vendors, forensics firms, and law enforcement.
- Customer support scripts and the volume of incoming queries.
Keep legal advice and privileged analysis separate from the operational log. If a regulator requests records, you want a clean file that demonstrates diligence, not a folder of contradictory notes.
Writing a Notice People Can Understand
Say what happened, when it happened, what information was involved, what you are doing about it, what the person can do, and where to get help. Then give them a way to ask questions. Plain sentences beat polished corporate hedging every time.
Avoid the reflex to call every incident "sophisticated." Sometimes an unpatched system or an open bucket was the cause, and people can tell when they are being managed. Keep the wording you send regulators, the wording you send customers, and the wording on your website consistent. Inconsistency is one of the fastest ways to turn a breach into a credibility problem.
A Practical First 72 Hours
Contain the incident without destroying evidence. Preserve logs before they roll over. Bring in outside counsel and a forensics team early if the scope is unclear. Start a decision log immediately, with timestamps and owners. Decide in advance who speaks to customers, regulators, and staff, so you are not improvising under pressure.
Then work the notification track alongside the technical one. Draft notices while facts are still firming up, check which jurisdictions and contracts apply, and calendar every deadline. If one of them falls inside 72 hours, treat it as your project plan, not a footnote.
Finally, remember that these laws vary by jurisdiction, change regularly, and interact with your contracts in ways that are easy to miss. The general guidance here is a starting point, not a substitute for advice from a qualified lawyer who knows your sector and your locations. The technical fix is usually the easy part; the paperwork is what regulators will judge you on.
Photo: Tima Miroshnichenko / Pexels
