Free tool
Breach notification deadline calculator
Enter when you found out and where the affected people are. See who you must tell, by when, in your local time.
Runs in your browser. Nothing is uploaded.
In a real incident, BreachClock builds the full notification plan with drafted notices for each regulator and the people affected.
This is an automated check and general information, not legal advice.
Why the first hours matter
When a breach or cyber incident is discovered, several clocks start at once, and they don't all run at the same speed. India's CERT-In Directions give 6 hours. An EU financial entity under DORA has 24 hours at most for its first notice, and NIS2 asks for an early warning within 24 hours. GDPR and UK GDPR give 72 hours to tell the data protection authority. A US public company has 4 business days after deciding an incident is material. Teams that work this out during the incident usually miss the earliest deadline.
What the calculator uses
The rules come from BreachClock, our incident notification product, and each one shows its legal source. The calculator only shows a hard deadline where the law states a clear period. Where a law says "without undue delay" or "as soon as practicable", it shows a recommended internal target instead and labels it that way, so you can see which times are legal limits and which are good practice.
- India: CERT-In reporting within 6 hours of noticing a listed cyber incident; under the DPDP Act and Rules, intimation to the Data Protection Board without delay and a detailed report within 72 hours, and notice to affected people without delay.
- EU: the supervisory authority within 72 hours where feasible (GDPR Article 33), affected people without undue delay when the risk is high (Article 34), and NIS2 and DORA timelines for the organisations they cover.
- UK: the ICO within 72 hours where feasible, and affected people without undue delay when the risk is high.
- US: SEC Form 8-K Item 1.05 within 4 business days of the materiality decision, HIPAA notices within 60 days of discovery, and state breach laws, which vary.
- Australia: an assessment within 30 days of suspecting an eligible data breach, then the OAIC and affected people as soon as practicable.
When the clock starts
Most deadlines run from when you became aware of the incident, not from when it began. Being aware usually means having a reasonable degree of certainty that something happened, but regulators expect you to investigate promptly; you can't delay awareness by not looking. Write down the exact time the incident was noticed or reported to you. It's the most important fact in your first report.
What to do in the first hour
- Record the time you became aware and who told you.
- Contain the incident, and preserve logs, disk images and emails before rebuilding anything.
- Work out where the affected people and systems are, and whether personal data was involved.
- Send the initial reports with what you know; most regimes expect an update later rather than a perfect first report.
- Keep a written record of every decision, including a decision not to notify and why.
Limits of this calculator
It covers the main national rules in five regions. It doesn't cover sector regulators such as RBI, SEBI or IRDAI in India, every US state law, contractual notice periods in your customer agreements, or cyber insurance policy terms, which often require notice within 24 to 72 hours. Check those separately, and confirm your obligations with a lawyer.
FAQ
Questions
How long do I have to report an incident to CERT-In?
Six hours from noticing it or being told about it, for the incident types listed in the CERT-In Directions of April 2022.
Is the GDPR 72 hours calendar time or working days?
Calendar time, including weekends and holidays, from when you became aware of the breach. If you report later, you must explain the delay.
Do I have to tell affected people as well as the regulator?
Often, yes. Under GDPR and UK GDPR you tell individuals when the breach is likely to result in a high risk to them. India's DPDP framework expects notice to affected data principals without delay.
When does the SEC 4-business-day clock start?
When the company determines the incident is material, which must happen without unreasonable delay after discovery. Enter that date to calculate the deadline.
What if I miss a deadline?
Report as soon as you can and explain the delay. A late report is better than none, and most regulators look at how you handled the incident overall.
Does this tool store anything about my incident?
No. It runs entirely in your browser and nothing you enter is sent to us.