Legal clocks: triggers and deadlines

• GDPR Article 33(1), notice to supervisory authority

  Jurisdiction

  European Union

  Trigger

  Controller becomes aware, meaning a reasonable degree of certainty that personal data was compromised ²

  Deadline

  Without undue delay and, where feasible, not later than 72 hours ²

• GDPR Article 33(2), processor to controller

  Jurisdiction

  European Union

  Trigger

  Processor becomes aware of a breach ²

  Deadline

  Without undue delay ²

• GDPR Article 34(1), notice to individuals

  Jurisdiction

  European Union

  Trigger

  Breach likely to result in a high risk to individuals ²

  Deadline

  Without undue delay ²

• UK GDPR Article 33(1)

  Jurisdiction

  United Kingdom

  Trigger

  Controller becomes aware of the breach ³

  Deadline

  Without undue delay and, where feasible, not later than 72 hours ³

• Notifiable Data Breaches scheme, s26WH

  Jurisdiction

  Australia

  Trigger

  Grounds to suspect an eligible data breach ⁴

  Deadline

  Take all reasonable steps to assess within 30 calendar days ⁴

• Notifiable Data Breaches scheme, ss26WK and 26WL

  Jurisdiction

  Australia

  Trigger

  Awareness of an eligible data breach ⁴

  Deadline

  As soon as practicable ⁴

• HIPAA Breach Notification Rule, individual notice

  Jurisdiction

  United States

  Trigger

  Discovery of a breach of unsecured protected health information ⁵

  Deadline

  Without unreasonable delay and no later than 60 days ⁵

• HIPAA Breach Notification Rule, notice to the Secretary for breaches affecting fewer than 500 people

  Jurisdiction

  United States

  Trigger

  End of the calendar year in which breaches are discovered ⁵

  Deadline

  No later than 60 days ⁵

• SEC Form 8-K Item 1.05

  Jurisdiction

  United States

  Trigger

  Company determines a cybersecurity incident is material ⁶

  Deadline

  Four business days, with possible delay on an Attorney General finding ⁶

• CERT-In Directions of 28 April 2022

  Jurisdiction

  India

  Trigger

  Noticing a listed cyber incident ⁷

  Deadline

  Within 6 hours ⁷

• Resolution CD/ANPD No. 15 of 24 April 2024, arts 6 and 9

  Jurisdiction

  Brazil

  Trigger

  Security incident with personal data. The ANPD page read does not state when the count starts ⁸

  Deadline

  Three working days for the ANPD and data subjects ⁸

• Limitation Act 1980 s2, tort

  Jurisdiction

  England and Wales

  Trigger

  Date the cause of action accrued ⁹

  Deadline

  Six years ⁹

• Limitation Act 1980 s5, simple contract

  Jurisdiction

  England and Wales

  Trigger

  Date the cause of action accrued ¹⁰

  Deadline

  Six years ¹⁰

• 28 U.S.C. 1658(a)

  Jurisdiction

  United States

  Trigger

  Cause of action accrues, for Acts of Congress after the section ¹¹

  Deadline

  4 years, except as otherwise provided by law ¹¹

• 28 U.S.C. 1658(b), securities fraud

  Jurisdiction

  United States

  Trigger

  Discovery of the facts, or the violation itself ¹¹

  Deadline

  Earlier of 2 years from discovery or 5 years from the violation ¹¹

• Limitation Act 1959 s6(1)(a)

  Jurisdiction

  Singapore

  Trigger

  Accrual of a cause of action in contract or tort ¹²

  Deadline

  Six years ¹²

Nothing matches. Clear the search or pick another filter.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@sequenceofrecord.com.