What is Incident & Breach Notification?
Incident and breach notification is the obligation to tell regulators, affected individuals and other parties about a security incident or personal data breach within the deadlines and in the form each applicable law sets. GDPR gives the supervisory authority 72 hours from awareness; HIPAA gives individuals 60 calendar days from discovery.
- Incident and breach notification is the legal duty to tell regulators, affected people and sometimes investors or the media about a breach, each on its own clock.
- GDPR runs two clocks: the supervisory authority within 72 hours of awareness (Art. 33) unless the breach is unlikely to result in a risk, and individuals without undue delay only when the risk is high (Art. 34).
- HIPAA gives 60 calendar days from discovery to notify individuals, with HHS told at the same time for breaches of 500 or more and the media for more than 500 residents of a state.
- The clock starts at awareness or discovery, not at the end of the investigation, so triage and legal review have to run in parallel.
- SmartSuite Privacy Management logs privacy incidents and tracks regulator and customer notifications, communications and evidence.
What is incident and breach notification?
Incident and breach notification is the obligation to tell regulators, affected individuals and other parties about a security incident or personal data breach within the deadlines and in the form each applicable law sets.
The clocks differ by regime. Under GDPR Article 33 a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals; a processor must notify the controller without undue delay. Article 34 adds a separate duty to tell the affected individuals, without undue delay, only when the breach is likely to result in a high risk to their rights and freedoms. The HIPAA Breach Notification Rule at 45 CFR 164.404 requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured protected health information.
Why it matters
- Late or missing notification is a separate breach of the law, assessed on top of whatever caused the incident.
- One incident can start the GDPR, HIPAA, state breach law and SEC clocks on the same day.
- Regulators judge the response by the record: when the organization became aware, what it assessed, whom it told and when.
Who must be told, and by when?
| Regime | Recipient | Deadline | Threshold |
|---|---|---|---|
| GDPR Art. 33 | Supervisory authority | Without undue delay, where feasible within 72 hours of awareness | Unless unlikely to result in a risk to individuals |
| GDPR Art. 34 | Affected individuals | Without undue delay | Likely to result in a high risk |
| HIPAA 45 CFR 164.404 and 164.408 | Individuals; HHS; media for more than 500 residents of a state | 60 calendar days after discovery; HHS at the same time for 500 or more, else an annual log within 60 days of year end | Breach of unsecured protected health information |
| SEC Form 8-K Item 1.05 | Investors | Four business days after the materiality determination | Material cybersecurity incident |
How does a notification process work?
- Log and start the clock. Record the moment the organization became aware; every deadline counts from it.
- Assess the risk. Establish what data, how many people and what harm is likely; this decides which duties apply.
- Decide per regime. Map the incident to each law in scope and record the decision to notify or not, with the reasoning.
- Notify in the required form. Each recipient has its own content requirements; GDPR allows information to be given in phases.
- Keep the evidence. Store the assessment, notices, timestamps and follow-up actions together; an inquiry asks for exactly this.
Related terms
- Data breach
- GDPR compliance
- HIPAA compliance
- Incident response
- Security incident management
- Privacy risk assessment
In SmartSuite
SmartSuite Privacy Management logs privacy incidents and breaches with severity, scope and risk scoring, tracks the investigation, containment and remediation workflow, and keeps communication logs and regulatory notification tracking on the same record so notices, timestamps and evidence are in one place.
Frequently asked questions
Does every breach have to be reported to the regulator?
No. GDPR exempts breaches that are unlikely to result in a risk to individuals, and individuals are told only when the risk is high. HIPAA presumes a breach unless a documented risk assessment shows a low probability that the health information was compromised. In both cases the decision not to notify must be recorded with its reasoning.
When does the GDPR 72-hour clock start?
It starts when the controller becomes aware of the breach, not when the investigation ends. Article 33 allows the notification to be made in phases where all the facts are not yet available, and a notification made after 72 hours must state the reasons for the delay, so the first notice can be partial but it should not be late.
What is the difference between an incident and a breach?
A security incident is any event that threatens the confidentiality, integrity or availability of systems or data. A breach is the subset where personal or protected data was actually accessed, disclosed, altered, lost or destroyed without authorization. Notification duties attach to breaches, but the clock often starts during the incident, before the breach is confirmed.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.