AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 09/29/2026 at 2:00 PM EST
Breach Notices Run on Separate Clocks
Coverage from Wisconsin Law Journal, HELBING Kanzlei für IT- und Datenschutzrecht, and others
Organizations face different notification duties when a security incident exposes personal data, with reportability and deadlines varying by law and jurisdiction.
GDPR generally sets a 72-hour deadline for notifying a supervisory authority when a breach is likely to risk individuals’ rights and freedoms; HIPAA and SEC rules use different triggers and timelines, while U.S. state requirements also vary. These differences make early assessment, clear records, and tested response procedures important for meeting obligations as facts develop.
Looking Back
157 Day Timeline
Apr 25
May 23
Jun 13
Jul 11
Aug 8
Aug 29
Sep 26
History
09/29/2026
The current version adds a clarification that GDPR requires notifying affected individuals only when a breach poses a high risk; the broader cross-regime notification framework is otherwise unchanged.
08/24/2026
The story now emphasizes coordinated decision-making across overlapping privacy, healthcare, securities, and state regimes, adding concrete HIPAA and SEC deadlines to GDPR’s benchmark. It also gives greater weight to documenting non-notified incidents and using staged reporting as investigations evolve.
All Articles53 articles
Important
When a breach affects client information, U.S. law firms should activate a tested response plan, coordinate forensic work through counsel, and assess notice obligations under professional and state rules.
9/28/2026 • Cybersecurity (Privacy-Relevant) • General
Under GDPR, organizations in the European Union must assess and document personal data breaches and notify authorities within 72 hours when risks to individuals exist.
8/4/2026 • Regulation, Law & Enforcement • General
HHS recorded 170 email-related healthcare data breaches affecting more than 2.5 million people in the United States during 2025.
7/30/2026 • Data Breaches & Exposure Events • General
Crowdfunding teams using tested incident response plans can reduce breach costs by improving breach classification, evidence preservation, and staged backer and regulator notifications.
7/22/2026 • Data Breaches & Exposure Events • General
Ransomware leak publication of mortgage-lender records can trigger discovery-based breach-notification duties across multiple states, complicating timing and communications.
7/20/2026 • Regulation, Law & Enforcement • General
After unauthorized access, startups must meet state breach-notification deadlines and FTC data-security enforcement expectations while following incident-response lifecycle practices.
7/17/2026 • Regulation, Law & Enforcement • General
Swiss data protection and cybersecurity rules require FDPIC high-risk breach notifications and 24-hour NCSC initial cyberattack reports, using coordinated incident response steps.
6/28/2026 • Regulation, Law & Enforcement • General
GDPR Article 33 guidance explains how breach awareness triggers supervisory authority notifications within 72 hours and how EU regulators coordinate under the one-stop-shop mechanism.
6/25/2026 • Regulation, Law & Enforcement • General
EDPB announced a standardized GDPR data breach notification template, and Pinsent Masons experts assessed reporting scope versus the 72-hour notice requirement.
6/17/2026 • Regulation, Law & Enforcement • General
UK organizations must notify the ICO within 72 hours of personal data breach awareness based on risk assessment and documented evidence under UK GDPR.
6/14/2026 • Regulation, Law & Enforcement • General
EDPB adopted a draft common GDPR data breach notification template on 10 June 2026 for EU DPAs, with consultation through 5 August 2026.
6/12/2026 • Regulation, Law & Enforcement • General
Organizations in Finland receive practical instructions for notifying personal data breaches to the Finnish Data Protection Ombudsman via e-form within 72 hours under GDPR Article 33.
6/11/2026 • Regulation, Law & Enforcement • General
Alation released a 72-hour breach-response checklist outlining roles, data governance inventory, and GDPR notification planning during ransomware incidents.
6/8/2026 • Data Breaches & Exposure Events • General
GDPR breach guidance describes how to assess risk, document incidents, and notify authorities within 72 hours after awareness, including data subject notice for high-risk cases.
6/4/2026 • Regulation, Law & Enforcement • General
A privacy breach response guide compares GDPR 72-hour rules, HIPAA 60-day notice, SEC 8-K filings, and U.S. state timelines and evidence preservation.
5/15/2026 • Regulation, Law & Enforcement • General
New Jersey and New York pending breach-notification bills would require more specific notice and add time-bound consumer credit and identity-theft support obligations.
5/21/2026 • Regulation, Law & Enforcement • General
Organizations worldwide should use coordinated incident response to investigate, contain and disclose data breaches while meeting jurisdiction-specific privacy obligations.
9/9/2026 • Cybersecurity (Privacy-Relevant) • General
Organizations experiencing data breaches must immediately contain affected systems, preserve evidence, assess exposed information, and notify authorities and individuals in applicable jurisdictions.
7/30/2026 • Data Breaches & Exposure Events • General
HR security teams respond to HR platform breaches by scoping exposed data, assessing GDPR and CCPA notification duties, and applying rapid employee protections.
7/19/2026 • Data Breaches & Exposure Events • General
Novo Nordisk and Tata Electronics incident examples show how US, UK, and EU regulators scrutinize breach notification and response failures beyond initial hacks.
7/3/2026 • Cybersecurity Tech (Privacy-Relevant) • General
New York Department of Financial Services enforced retention and breach-notification requirements against Delta Dental Insurance Company after a financial breach.
6/3/2026 • Regulation, Law & Enforcement • General
Data breach definitions, causes, and consequences are outlined alongside GDPR and HIPAA reporting obligations and operational impacts.
5/30/2026 • Data Breaches & Exposure Events • General
Utilities guidance details six phases for cloud incident response, emphasizing exposed-data assessment and shared responsibility for breach containment and notification.
7/18/2026 • Data Breaches & Exposure Events • General
EDPB opened consultation on a standardized template for GDPR Article 33 breach notifications to reduce EU-wide variation until 5 August 2026.
6/18/2026 • Regulation, Law & Enforcement • General
Breach-notification requirements in the U.S. typically notify patients and regulators, while direct FBI or Secret Service contact applies when breaches include ransomware, extortion, or payment fraud risk.
5/29/2026 • Regulation, Law & Enforcement • General
Interesting
The European Data Protection Board is revising an EU-wide GDPR personal data breach notification template after Insurance Europe and Wouter Seinen criticized excessive early reporting requirements.
8/18/2026 • Regulation, Law & Enforcement • General
Ransomware incidents can require breach notifications under HIPAA, FTC Safeguards Rule, state statutes, Form 8-K, DFARS 252.204-7012, and GDPR when personal data access or exfiltration occurs.
7/20/2026 • Regulation, Law & Enforcement • General
Guidance directs organizations handling suspected ransomware or Microsoft 365 account compromise to preserve evidence and meet Wisconsin Wis. Stat. § 134.98 breach-notification timelines.
7/9/2026 • Data Breaches & Exposure Events • General
European Data Protection Board standardizes GDPR breach notification with a consultation ending August 5, 2026 to reduce EU member-state disclosure fragmentation.
7/1/2026 • Regulation, Law & Enforcement • General
EDPB adopted a GDPR Article 33 breach-notification template for EU DPAs, with public consultation open until 5 August 2026.
6/28/2026 • Regulation, Law & Enforcement • General
UK GDPR breach guidance outlines how organizations should define personal data breaches, run breach management teams, and plan notification and response.
6/17/2026 • Regulation, Law & Enforcement • General
Small business guidance recommends a documented incident response plan to speed breach containment, evidence handling, and state-specific notification.
6/7/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Enterprises are advised to implement data breach incident response plans aligned with GDPR, CCPA/CPRA, and HIPAA reporting timelines.
6/1/2026 • Regulation, Law & Enforcement • General
Regulators worldwide are tightening breach reporting rules, requiring organizations to notify authorities and affected individuals quickly based on breach awareness rather than confirmed incidents.
4/27/2026 • Regulation, Law & Enforcement • General
US businesses are advised in 2025-2026 guidance to use rehearsed data breach response plans for early exfiltration containment, legal notification, and recovery.
4/27/2026 • Regulation, Law & Enforcement • General
Singapore SMEs should contain ransomware and data breaches, preserve evidence, and notify PDPC within three days for notifiable incidents likely to cause significant harm.
7/17/2026 • Data Breaches & Exposure Events • General
EDPB adopted a common GDPR personal data breach notification template in June 2026, with public consultation open until 5 August 2026 across EU Member States.
6/29/2026 • Regulation, Law & Enforcement • General
The EDPB adopted a GDPR breach-notification template in June 2026 and opened a consultation until 5 August 2026 for EU Member State implementation planning.
7/1/2026 • Regulation, Law & Enforcement • General
After a data breach, Georgia notification obligations under O.C.G.A. 10-1-910 to 10-1-912 shape rapid containment, forensics, and communications decisions for affected businesses.
7/16/2026 • Data Breaches & Exposure Events • General
In Spain, the Data Protection Agency reported 2,765 personal data breaches in 2025, with about 11 cases referred for investigation under GDPR risk-based notification.
6/22/2026 • Data Breaches & Exposure Events • General
UK ICO guidance and the Data (Use and Access) Act 2025 raise expectations for 72-hour breach notification and risk documentation for SME personal data incidents.
6/17/2026 • Cybersecurity (Privacy-Relevant) • General
Organizations improve breach outcomes by using tested incident response plans, including AI-assisted detection, compliance notification, and structured containment and recovery.
4/25/2026 • Cybersecurity (Privacy-Relevant) • General
The EDPB adopted a draft GDPR personal data breach notification template during June 2026, open for public consultation until August 5, 2026, to harmonize reporting across EU supervisory authorities.
6/14/2026 • Regulation, Law & Enforcement • General
Law firms should use annually tested breach response plans to coordinate evidence preservation, insurer notice, client communications, and decisions during incidents.
8/28/2026 • Cybersecurity (Privacy-Relevant) • General
Organizations should use data breach response plans during the first 24 hours of incidents across business operations to coordinate containment, evidence preservation and legally required notifications.
8/6/2026 • Data Breaches & Exposure Events • General
Breach response guidance recommends isolating compromised systems first and aligning notifications to GDPR, NIS2, HIPAA, CIRCIA, and SEC timelines within 24 hours.
7/25/2026 • Data Breaches & Exposure Events • General
Cross-border startups are advised to contain suspected breaches and, when personal data is exposed, notify relevant regulators under GDPR Article 33 within 72 hours.
7/19/2026 • Data Breaches & Exposure Events • General
A privacy- and ransomware incident-response checklist outlines evidence preservation, containment sequencing, and legal review of breach notification duties.
7/12/2026 • Data Breaches & Exposure Events • General
EDPB adopted an EU-wide template for GDPR Article 33 breach notifications, with a consultation running until 5 August 2026.
6/28/2026 • Regulation, Law & Enforcement • General
Small businesses face costly privacy harms from ransomware, phishing, and credential theft incidents, with Microsoft reporting high average breach costs and prolonged recovery timelines.
4/29/2026 • Cybersecurity (Privacy-Relevant) • General
FTC guidance urges small businesses to train employees, use email authentication, and prepare for data breaches to reduce phishing-based theft of personal information.
7/20/2026 • Cybersecurity (Privacy-Relevant) • General
Mastercard and IBM estimates in 2025 show substantial data breach exposure for small businesses, alongside FTC security planning guidance for incident response and sensitive data handling.
5/21/2026 • Corporate Data Practices & Accountability • General
Heather Shumaker and Lucia Argento explain federal reporting requirements for cyber incidents affecting critical infrastructure and recommended preparation steps.
6/25/2026 • Cybersecurity Tech (Privacy-Relevant) • General