Global Breach Notification Deadlines: A Guide for US Companies

If your company is based in the US but holds data on customers or employees in Europe, the UK, Canada, Australia or Brazil, a single breach can start several legal clocks at once. The shortest are measured in hours or business days, not weeks: 72 hours to a European or UK regulator, three business days in Brazil, and four business days after a materiality decision for a US public company filing with the SEC. Other regimes say “as soon as feasible” or “as soon as practicable,” which still means fast.

Every one of those notices depends on the same thing: knowing what happened, which systems were touched and whose data was exposed. That is forensic scoping, and it is why cyber incident response has to start before the lawyers draft the first notice. This guide lays out the main deadlines side by side, explains how scoping drives each notice, and ends with a first-72-hours checklist. This is general information, not legal advice. Confirm every obligation with counsel in each country involved.

Why a US company can owe notice in another country

Data protection laws tend to follow the people whose data you hold, not where your servers or headquarters sit. The EU General Data Protection Regulation (GDPR) is the clearest example. Article 3(2) applies it to organizations outside the EU that offer goods or services to people in the EU, or that monitor their behavior in the EU. A US online retailer shipping to Germany, or a US software company tracking how French users use its app, can fall inside it.

Employee data counts too. If you have staff in a UK branch, a Canadian sales office or an Australian subsidiary, their HR records, payroll files and mailboxes are personal data under local law. A breach of your US email tenant can expose those records even though nothing happened overseas.

So the first legal question after a breach is not only “what was taken?” but “whose was it, and where do they live?”

Breach notification deadlines compared

The table below summarizes the main rules as of October 2026. Read the notes under it before relying on any single cell.

Regime	When notice is required	Deadline to the regulator	Notice to individuals
EU GDPR (Articles 33 and 34)	Personal data breach, unless unlikely to result in a risk to people’s rights and freedoms	Without undue delay and, where feasible, within 72 hours of becoming aware; reasons required if late	Without undue delay when the breach is likely to result in a high risk
UK GDPR (ICO)	Breach where a risk to people is likely	As soon as possible and, where feasible, within 72 hours	Without undue delay when the risk is high
Canada PIPEDA	Breach of security safeguards creating a real risk of significant harm	As soon as feasible after determining the breach occurred	As soon as feasible; also notify organizations that can reduce the harm
Australia Notifiable Data Breaches scheme	Eligible data breach likely to result in serious harm	Assess a suspected breach within 30 days at most; statement to the OAIC as soon as practicable	As soon as practicable after preparing the statement
Brazil LGPD (ANPD Resolution 15/2024)	Security incident that may create relevant risk or harm to data subjects	Three business days from learning the incident affected personal data	Three business days, same trigger
US SEC Form 8-K Item 1.05	Cybersecurity incident the public company determines is material	Four business days after the materiality determination	Not an individual notice; a public filing
US state laws	Varies by state	Varies by state	Varies by state

EU GDPR. Article 33 lets you provide information in phases when you do not have it all yet, and requires you to document every personal data breach, including ones you do not report. If a service provider (a processor) suffers the breach, it must tell you without undue delay. The European Data Protection Board says a controller becomes “aware” when there is a reasonable degree of certainty that a security incident has compromised personal data. If you have no establishment in the EU, ask counsel which supervisory authority or authorities should receive your notice.

UK GDPR. The Information Commissioner’s Office (ICO) takes reports through an online form that cannot be saved partway, so gather the facts first. The ICO notes its guidance is under review after the Data (Use and Access) Act 2025 became law on 19 June 2025, so check its current pages when you report.

Canada. Under the Personal Information Protection and Electronic Documents Act, “significant harm” includes bodily harm, humiliation, damage to reputation or relationships, and financial harm. Since 1 November 2018, regulations have required organizations to keep a record of every breach of security safeguards for 24 months, whether or not it was reported.

Australia. The Office of the Australian Information Commissioner (OAIC) expects a suspected breach to be assessed within 30 calendar days and treats that as a maximum, not a target. The scheme generally covers organizations with annual turnover above AUD 3 million, plus some smaller ones such as health service providers. An Australian entity that sends data overseas stays responsible for assessing a breach of that data.

Brazil. Brazil’s National Data Protection Authority (ANPD) published Resolution CD/ANPD No. 15 in April 2024. It allows a preliminary notice followed by a complementary one, and small processing agents get double the time. Controllers must keep a record of incidents for at least five years.

US public companies. The SEC rules adopted in July 2023 require a materiality decision without unreasonable delay after discovery. Disclosure can be delayed only if the US Attorney General finds that it would pose a substantial risk to national security or public safety. Foreign private issuers report on Form 6-K.

US states. According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico and the US Virgin Islands have breach notification laws. Deadlines, triggers and regulator notices vary. For one state’s rules in detail, see our guide to the Arizona data breach notification law.

Forensic scoping drives every notice

Every regulator on that list asks the same core questions. What happened? When? What categories of data, and how many people? What have you done about it? A notice that guesses at those answers can overstate the breach or understate it and need a public correction.

Forensic scoping turns suspicion into facts you can put in writing. In a typical engagement that means:

• Establishing the window. When did the attacker first get in, and when were they removed? Sign-in logs, endpoint telemetry and firewall records set the start and end dates.
• Tracing access. Which mailboxes, file shares, databases and cloud apps did the attacker touch? Access is not the same as theft, and the difference matters for “likely risk” decisions.
• Looking for exfiltration. Large outbound transfers, cloud sync activity and archive files left behind can show whether data actually left.
• Mapping data to people and countries. Once you know which systems were exposed, you can work out whose records sat in them and where those people live. That list decides which regimes apply.

Scoping is rarely finished in 72 hours. That is expected, and the GDPR and Brazil’s rules both allow phased notices. The goal in the first days is a defensible initial picture, clearly labeled as preliminary, with forensics continuing behind it.

Preserve evidence while you notify

The pressure to restore systems is strongest in the same hours you most need to preserve them. Rebuilding a server or resetting a cloud tenant before it is imaged can erase the logs that prove what an attacker did, and sometimes the logs that prove what they did not do. Without those records, you may have to assume the worst and notify everyone.

Practical steps that let notification and preservation run side by side:

• Isolate affected machines from the network rather than wiping or powering them off without a plan, so memory and disk evidence survive.
• Export cloud audit and sign-in logs early. Many platforms keep them for a limited time, and the clock does not stop for an incident.
• Take forensic images of key systems, hash them and record who handled them, so the evidence holds up if a regulator, insurer or court asks. Our guide to remote forensic collection explains how this works when the systems are in another state or country.
• Keep one written timeline of decisions and findings. Regulators may ask why you notified when you did.
• Talk to counsel about privilege before reports are written. How the forensic work is engaged can affect who sees the findings.

First 72 hours checklist

Use this as a working list for leadership, counsel and the response team.

Hours 0 to 4

1. Name an incident lead and open a written log with times in a single time zone (UTC avoids confusion across offices).
2. Contain: isolate affected devices, disable compromised accounts and block known malicious addresses.
3. Preserve: stop any planned wipes or rebuilds until key systems are imaged and logs are exported.
4. Notify your cyber insurer under the policy’s notice terms and engage outside counsel.
5. Switch to out-of-band communication if email or chat may be compromised.

Hours 4 to 24

1. Start forensic scoping: entry point, timeline, systems touched and signs of data leaving.
2. Build a preliminary data map of what sat in the affected systems and which countries’ residents it covers.
3. Counsel lists every regime that may apply and the earliest deadline among them.
4. For a public company, brief the people responsible for the materiality decision.
5. Check contracts. Customers and partners may require notice faster than any law.

Hours 24 to 72

1. Draft regulator notices with what is known, what is not yet known and what you are doing about it.
2. File the earliest-deadline notices first; plan phased updates where the law allows them.
3. Prepare individual notices and support (call center scripts, FAQs, credit monitoring where appropriate) for when counsel decides they are due.
4. Record why any breach is assessed as not reportable, with the evidence behind that decision.
5. Schedule the next scoping update and keep the timeline current.

A plan that has been tested makes these hours far easier. If you do not have one, incident response planning and tabletop exercises are the place to start. Run at least one exercise that includes a foreign office, so the team practices working with two or three deadlines at once.

How Honeybadger Solutions helps

Honeybadger Solutions is a veteran-led cyber security and digital forensics firm based in Arizona. Our incident response service covers triage, containment, eradication, recovery, forensics and reporting, and is delivered remotely by our own team to clients across the US and internationally.

For breach notification work, that means:

• Forensic scoping that answers the questions regulators ask: timeline, systems, data categories and evidence of exfiltration.
• Evidence preserved with chain of custody. Devices and data from outside Arizona, including outside the US, are collected remotely or sent to us by mail and examined in our Arizona lab.
• Court-ready documentation and a post-incident report for leadership, insurers, regulators and counsel.
• Coordination with your legal counsel and cyber insurer. Counsel decides what to notify and when; we supply the facts.
• Retainers with pre-agreed terms, so we know your environment before something goes wrong. Response targets are written into each service agreement, and quotes are written and given before any work starts.

If you are dealing with a breach now, use our urgent intake form. To prepare ahead, request incident response services online or book a confidential consultation.

Frequently asked questions

When does the 72-hour GDPR clock start?

It starts when the controller becomes aware of the breach. European regulators describe that as the point where there is a reasonable degree of certainty that a security incident has compromised personal data. A short initial investigation to establish that is expected, but it should not be used to delay.

Do we have to notify if we do not know yet what was taken?

Often, yes. The GDPR and Brazil’s rules let you file with what you know and add information in phases. Waiting for a complete picture can mean missing the deadline, so counsel usually files a preliminary notice and updates it as forensics continues.

Does the SEC four-day rule start when we discover the breach?

No. The four business days start when the company determines the incident is material. That determination must be made without unreasonable delay after discovery, so the company cannot hold off deciding to buy time.

Can you notify regulators for us?

Notification decisions belong to you and your counsel, who know the legal position in each country. We provide the forensic findings, timelines and documentation those notices rely on, and we support follow-up questions from regulators and insurers.

Sources: GDPR Article 33, GDPR Article 34, GDPR Article 3, territorial scope, EDPB: Data breaches guide for SMEs, ICO: Report a personal data breach, PIPEDA sections 10.1 to 10.3, Breach of Security Safeguards Regulations (SOR/2018-64), OAIC: Notifiable Data Breach scheme, ANPD: Communication of security incidents, Mattos Filho: summary of ANPD Resolution 15/2024, SEC press release 2023-139, SEC cybersecurity disclosure fact sheet, NCSL: Security breach notification laws

Related reading

• ▸ The Glass Castle: Securing the Executive Home Network
• ▸ Mexico Security Threat Report 2026: Cross-Border Risk Assessment for US Business Operations
• ▸ Managed Security Services (MSSP): What They Are and Why Your Business Needs One
• ▸ Data Breach Response for Small Business: A Step-by-Step Plan