| NERC CIP-008-6 (North American grid) |
1 hour |
Determination that a Reportable Cyber Security Incident occurred. Attempted compromises: by end of the next calendar day. Report to E-ISAC and CISA; updates within 7 calendar days. |
Bulk electric system entities |
NERC CIP-008-6 |
| China — Cybersecurity Incident Reporting Measures † |
1 hour (CII operators)
2 hours (state bodies)
4 hours (other operators) |
Becoming aware of a “relatively major” or larger incident. In force since November 1, 2025. |
Network operators in China |
† Latham & Watkins summary
Official text is published in Chinese by the CAC; figures confirmed from an English law-firm summary. |
| Singapore Cybersecurity Act (CII) |
2 hours
72h supplementary
30-day final |
Becoming aware of a prescribed incident — since October 31, 2025 this includes suspected advanced persistent threats and incidents on connected supplier systems. Supplementary details within 72 hours of awareness; final report within 30 days of those. |
Critical Information Infrastructure owners |
CSA (regulator) · CSA notice, Oct 2025
Singapore's statute site blocks automated reading; figures are from the regulator's own pages. |
| EU DORA |
4 hours
(≤24h from awareness) |
Classification as a major ICT-related incident, and no later than 24 hours after becoming aware. Intermediate report within 72 hours of the initial notification; final report within one month of the intermediate report. |
EU financial entities |
Delegated Reg. (EU) 2025/301, Art. 5 |
| India CERT-In Directions (2022) |
6 hours |
Noticing the incident, or being told of it. |
Service providers, intermediaries, data centres, companies and government bodies in India |
CERT-In Directions, 28 Apr 2022 |
| Australia SOCI Act |
12 hours (critical)
72 hours (other) |
Becoming aware. 12 hours for a critical incident (significant impact); 72 hours for other incidents (relevant impact). |
Responsible entities for critical infrastructure assets |
SOCI Act ss 30BC, 30BD |
| EU NIS2 |
24h early warning
72h notification
1-month final |
Becoming aware of a significant incident. Final report within one month of the 72-hour notification. Each member state implements this in its own law — check yours. |
Essential and important entities |
Directive (EU) 2022/2555, Art. 23 |
| U.S. TSA Security Directives |
24 hours |
A cybersecurity incident being identified. Report to CISA. |
Designated pipeline operators (SD Pipeline-2021-01 series) and rail carriers (SD 1580-21-01 series) |
TSA rail SD 1580-21-01C · Federal Register, Jan 2025
The newest pipeline directive (01G) could not be read automatically; TSA and the Federal Register both state 24 hours for the series. |
| NYDFS Part 500 — extortion payment |
24 hours
+ reasons in 30 days |
Making an extortion payment. Written reasons the payment was necessary within 30 days. |
NYDFS-licensed entities |
23 NYCRR 500.17 |
| CISA CIRCIA — ransom payment |
24 hours |
Making a ransom payment. Pending: the clock is in the statute but applies only once CISA’s final rule takes effect — still under White House review as of October 5, 2026. |
Covered critical-infrastructure entities |
6 U.S.C. 681b · Status: HIPAA Journal |
| Mastercard account data compromise † |
24 hours |
Becoming aware of an account data compromise event or potential event: report “immediately and no later than 24 hours.” Contractual — flows through your acquirer agreement; PCI DSS itself sets no clock. |
Merchants and service providers handling Mastercard data |
† Mastercard ADC User Guide
The Mastercard guide we could read is dated 2017; confirm against Mastercard's current rules and your acquirer agreement. |
| Canada OSFI |
24 hours
(or sooner) |
A technology or cyber incident that meets OSFI’s reporting criteria: report within 24 hours, or sooner if possible. |
Federally regulated financial institutions in Canada |
OSFI incident reporting advisory |
| U.S. federal banking agencies |
36 hours |
Determining that an incident has risen to a “notification incident” (likely to materially disrupt operations). Bank service providers must tell their bank customers as soon as possible. |
Banks and holding companies supervised by the OCC, Federal Reserve or FDIC |
12 CFR 53.3 · 225.302 · 304.23 |
| GDPR / UK GDPR |
72 hours |
Becoming aware of a personal-data breach (“where feasible”). In the UK, notice now goes to the Information Commission, which replaced the ICO. Affected individuals: without undue delay where the risk to them is high. |
Organizations handling EU or UK residents' personal data |
GDPR Art. 33 · UK GDPR Art. 33 |
| NYDFS Part 500.17 |
72 hours |
Determining that a cybersecurity incident occurred. |
NYDFS-licensed entities |
23 NYCRR 500.17 |
| CISA CIRCIA — covered incident |
72 hours |
Reasonable belief that a covered cyber incident occurred. Pending: applies only once CISA’s final rule takes effect — still under White House review as of October 5, 2026. |
Covered critical-infrastructure entities |
6 U.S.C. 681b · Status: HIPAA Journal |
| DFARS 252.204-7012 |
72 hours |
Discovery of a cyber incident. Report to DoD via DIBNet. |
Defense contractors handling covered defense information |
DFARS 252.204-7012 |
| Visa account data compromise |
3 calendar days
(acquirer: immediately) |
Discovering evidence that raises a reasonable suspicion of a compromise. Tell your acquiring bank immediately and Visa within three calendar days. Contractual — PCI DSS itself sets no clock. |
Merchants and service providers handling Visa data |
Visa: What To Do If Compromised v10.0 (Jun 2026) |
| Australia ransomware payment (Cyber Security Act 2024) |
72 hours |
Making the payment (or becoming aware it was made). In force since May 30, 2025. |
Businesses over A$3M turnover and critical-infrastructure entities |
Cyber Security Act 2024, s 27 · Home Affairs factsheet |
| U.S. state insurance laws (NAIC Model #668) |
72 hours |
Determining that a cybersecurity event occurred — in the 28 jurisdictions that had adopted NAIC's Insurance Data Security Model Law as of March 2026. Your state's enacted version governs. |
Insurance licensees |
NAIC Model Law #668 · NAIC adoption report |
| Philippines Data Privacy Act (NPC Circular 16-03) |
72 hours |
Knowledge of, or reasonable belief that, a personal data breach occurred. Notify the National Privacy Commission. |
Personal information controllers |
NPC Circular 16-03 |
| Brazil LGPD (ANPD Resolution 15/2024) † |
3 business days
(6 for small agents) |
Knowing that a security incident affected personal data. Notify the ANPD and the people affected. |
Controllers processing personal data in Brazil |
† Mattos Filho summary
Primary resolution is in Portuguese; confirmed from a Brazilian law-firm summary. |
| Japan APPI † |
≈3–5 days preliminary
30 days final (60 if malicious) |
Becoming aware of a reportable leak. Preliminary report to the Personal Information Protection Commission “promptly” (about 3–5 days); final report within 30 days, or 60 for incidents caused for a wrongful purpose. |
Businesses handling personal information in Japan |
† Nishimura & Asahi summary
Confirmed from a Japanese law-firm summary; the regulator text was not read directly. |
| SEC Form 8-K (Item 1.05) |
4 business days |
Materiality determination — not discovery, not Validation. The determination itself must be made “without unreasonable delay” after discovery. (A narrow DOJ national-security delay of up to 30, extendable 60, days can apply.) |
SEC reporting companies |
Form 8-K instructions |
| FCC breach rules (telecom) |
7 business days |
Reasonable determination of a breach. The codified rule requires notice to the Secret Service and FBI; the FCC's 2023 order (upheld August 2025) adds the FCC itself for breaches of 500+ customers, with parts still awaiting final federal clearance. |
Telecom carriers and interconnected VoIP providers |
47 CFR 64.2011 · Cooley on the 2025 ruling |
| SEC Regulation S-P (amended) |
30 days |
Becoming aware that customer information was, or is reasonably likely to have been, accessed without authorization. Service providers must tell the firm within 72 hours. |
Broker-dealers, investment advisers, funds and transfer agents (larger firms since Dec 3, 2025; smaller since Jun 3, 2026) |
17 CFR 248.30 |
| Australia Notifiable Data Breaches (Privacy Act) |
30 days to assess,
then as soon as practicable |
Becoming aware of a suspected eligible data breach: assess within 30 days; once confirmed, notify the OAIC and affected individuals as soon as practicable. |
Entities covered by the Privacy Act (most businesses over A$3M turnover, plus others) |
OAIC guidance (regulator) |
| GLBA Safeguards Rule (FTC) |
30 days |
Discovery of unauthorized acquisition of unencrypted customer information affecting 500+ consumers. |
Non-bank financial institutions |
16 CFR 314.4(j) |
| U.S. state breach laws † |
Varies — commonly 30–90 days |
Discovery, per each state's own statute. No single federal consumer-notice law exists — all 50 states set their own deadline, several as “without unreasonable delay” rather than a fixed number. California now requires notice within 30 calendar days (effective January 1, 2026), plus notice to its Attorney General within 15 days after that when more than 500 residents are affected. |
Any entity holding that state's residents' data |
† NCSL 50-state list · California change (Data Protection Report)
50 statutes, so we link an aggregator; California's legislature site blocks automated reading. |
| HIPAA Breach Notification Rule |
60 days |
Discovery. Individuals without unreasonable delay and within 60 calendar days. HHS at the same time if 500+ are affected (plus media notice); otherwise within 60 days after year-end. |
Covered entities & business associates |
45 CFR 164.404 · 164.408 |
| FTC Health Breach Notification Rule |
60 days |
Discovery of a breach of unsecured personal health records. Individuals within 60 calendar days; the FTC at the same time if 500+ people are affected, otherwise in an annual log. |
Health apps and other non-HIPAA vendors of personal health records |
16 CFR Part 318 |
| Canada PIPEDA |
“As soon as feasible” — no fixed number |
Determining that a breach creates a real risk of significant harm. Report to the Privacy Commissioner and notify affected individuals. Not charted: there is no number to plot. |
Private-sector organizations in Canada (outside provinces with their own law) |
PIPEDA s 10.1 |