OneTaskBy Tim King · Updated
Data Breach Notification Deadline
Exact Reporting Clocks for GDPR, UK GDPR, NIS2, DORA, HIPAA and SEC Breaches
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Data Breach Notification Deadline Calculator works
This data breach notification deadline calculator turns the time you found a breach into the exact dates and times you must report it. Pick the rule that applies, such as GDPR's 72 hours, and it lists each step, who to notify and what counts, so nothing is missed while you deal with the incident.
How the data breach notification deadline is counted
Most rules start the clock when you become aware of the breach, not when it happened. Under GDPR and UK GDPR you must tell the regulator within 72 hours unless the breach is unlikely to risk people's rights, and tell the people affected without undue delay if the risk is high. You can send an initial report and add details later.
NIS2 applies a layered approach to essential and important entities: an early warning within 24 hours, a fuller notification within 72 hours and a final report a month later. DORA sets even tighter times for EU financial firms, starting at 4 hours after a major incident is classified. HIPAA gives 60 days to notify people, with the timing for HHS depending on whether 500 or more were affected.
Listed US companies must file Form 8-K within four business days of deciding an incident is material, which this tool counts on weekdays without public holidays. Australia allows 30 days to assess a suspected breach. Check the exact rule with your adviser, as exemptions and sector rules vary.
Data breach notification deadline formula
Deadline = the moment you became aware + the time limit for the rule
GDPR and UK GDPR allow 72 hours to report to the regulator. NIS2 wants an early warning in 24 hours, a notification in 72 hours and a final report within a month. DORA wants an initial notice in 4 hours, an intermediate report in 72 hours and a final report within a month. HIPAA allows 60 days to tell individuals. The SEC wants Form 8-K within 4 business days of deciding the incident is material. Australia allows 30 days to finish an assessment.
Worked example: GDPR from a Friday morning
Aware at 09:00 on Friday 6 March 2026, the 72 hours run through the weekend, so the regulator report is due by 09:00 on Monday 9 March.
Worked example: SEC materiality on a Friday
A materiality decision on Friday 6 March counts 4 business days, Monday to Thursday, so Form 8-K Item 1.05 is due on Thursday 12 March.
Data breach notification reference table
Deadlines for a breach discovered at 09:00 on Friday 6 March 2026 affecting fewer than 500 people.
| Rule | Step | Due by | Who to notify |
|---|---|---|---|
| GDPR (EU) | Report to regulator | Mon 9 Mar 2026, 09:00 | your lead supervisory authority |
| GDPR (EU) | Tell affected people | Without undue delay | Individuals, when the breach is likely to result in a high risk to them |
| GDPR (EU) | Record the breach | Now | Your internal breach log |
| UK GDPR | Report to regulator | Mon 9 Mar 2026, 09:00 | the ICO |
| UK GDPR | Tell affected people | Without undue delay | Individuals, when the breach is likely to result in a high risk to them |
| UK GDPR | Record the breach | Now | Your internal breach log |
| NIS2 (EU) | Early warning | Sat 7 Mar 2026, 09:00 | Your national CSIRT or competent authority |
| NIS2 (EU) | Incident notification | Mon 9 Mar 2026, 09:00 | CSIRT or competent authority |
| NIS2 (EU) | Final report | By Thu 9 Apr 2026 | CSIRT or competent authority |
| NIS2 (EU) | GDPR check | Mon 9 Mar 2026, 09:00 | Data protection authority |
| DORA (EU financial) | Initial notification | Fri 6 Mar 2026, 13:00 | Your financial supervisor |
| DORA (EU financial) | Intermediate report | Mon 9 Mar 2026, 13:00 | Your financial supervisor |
| DORA (EU financial) | Final report | Thu 9 Apr 2026, 13:00 | Your financial supervisor |
| HIPAA (US health) | Notify individuals | Tue 5 May 2026 | Each affected person, by first-class mail or email if they agreed |
| HIPAA (US health) | Notify HHS | Mon 1 Mar 2027 | HHS Office for Civil Rights breach portal |
| HIPAA (US health) | Business associates | Now | The covered entity |
| SEC (US listed companies) | File Form 8-K Item 1.05 | Thu 12 Mar 2026 | The SEC via EDGAR |
| SEC (US listed companies) | Decide materiality | Without unreasonable delay | Your board or disclosure committee |
| SEC (US listed companies) | Amend the 8-K | As facts become known | The SEC |
| Australia (Notifiable Data Breaches) | Finish assessment | Sun 5 Apr 2026 | Internal |
| Australia (Notifiable Data Breaches) | Notify the OAIC | As soon as practicable | Office of the Australian Information Commissioner |
| Australia (Notifiable Data Breaches) | Notify individuals | As soon as practicable | Affected people, or publish a notice if direct contact is not practicable |
Quick answers
- The GDPR 72 hours include weekends and public holidays.
- A late GDPR report must explain the reasons for the delay.
- HIPAA breaches of 500 or more people also go to HHS and the media within 60 days.
- Smaller HIPAA breaches go to HHS within 60 days of the end of the calendar year.
- To find how many hours you have left, enter when you became aware above.
FAQ
Does the 72 hours include weekends?
Yes. The GDPR deadline counts calendar hours, so a breach found on a Friday afternoon must be reported by Monday afternoon. Regulators accept an initial report with details to follow if you need more time.
When does the clock start?
When you have a reasonable degree of certainty that a breach affecting personal data has happened. A short investigation to confirm it is fine, but deliberately delaying that step does not pause the clock.
What if we miss the deadline?
Report as soon as you can and explain the reasons for the delay, which GDPR requires. Late reporting is itself a breach of the rules and can add to any fine, so an incomplete early report is usually better.
Why do SEC deadlines skip holidays here?
The four days are business days, and US federal holidays shift the deadline too. The calculator skips weekends only, so if a holiday falls in the window, add a day and confirm the date with counsel.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Incident Response Checklist
A step-by-step checklist for the security incident you are facing.
Privacy Policy Generator
Write a plain-English privacy policy that matches your site's services.
Date Difference Calculator
Days, weeks and months between any two dates.
Cookie Consent Checker
Find analytics and ad cookies set before visitors give consent.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.