Data Breach Notification Requirements by Country (Small Business Guide)

This article provides general educational information. Data breach notification requirements are complex, jurisdiction-specific, and subject to change. Businesses facing an active breach should consult a qualified privacy attorney immediately.

The Problem: When a Breach Happens, You Have Hours — Not Days — to Figure This Out

A data breach is the worst week of most business owners’ lives. The technical response — identifying the source, containing the damage, restoring systems — is the visible part. The less visible part, which causes just as much harm if mishandled, is the legal one.

Every country where you have customers, every US state where affected individuals reside, and every regulated industry sector you operate in may have its own mandatory breach notification timeline. In the EU, you have 72 hours to notify the regulator before you’ve necessarily finished your investigation. In California (since January 2026), you have 30 days to notify affected residents. In Australia, you have 30 days to assess whether notification is required. In Canada, you must notify as soon as feasible. Miss any of these deadlines and the notification failure becomes a separate regulatory violation — on top of the underlying breach.

Booking.com was fined €475,000 specifically for notifying the Dutch DPA 22 days after discovering a breach, not for the breach itself. Permanent TSB received a specific €27,500 fine element for late notification in a May 2026 enforcement action. The DPP Law Ltd in the UK was explicitly fined in part for notifying the ICO 43 days after discovery.

These are not enterprise organisations that made sophisticated mistakes. They were businesses that didn’t have a documented notification process and lost the race against their own deadlines.

This guide gives you the country-by-country notification framework you need to build that process before you need it.

How to Use This Guide

The notification obligations you face after a breach depend on four factors:

1. Where affected individuals are located — not where your business is, but where the people whose data was compromised live
2. What type of data was involved — healthcare data, financial data, and payment card data each carry additional sector-specific notification requirements layered on top of general data protection law
3. Whether the breach meets the triggering threshold — most notification laws only require notification when the breach creates a real risk of harm to affected individuals, not for every security incident
4. What your assessment timeline is — the clock starts when you become aware of the breach (or when reasonable diligence would have revealed it), not when you finish your investigation

Multi-jurisdiction breaches require running these four questions for each relevant jurisdiction simultaneously. A US business that has EU customers and California customers and processes payment card data may owe simultaneous notifications to: the relevant EU data protection authority (72 hours under GDPR), affected EU individuals (as soon as possible if high risk), the California Attorney General if more than 500 California residents are affected, affected California residents within 30 days, HHS if protected health information is involved (60 days), and the PCI Forensic Investigator process if cardholder data was compromised.

The section at the end of this article provides a decision framework for working through multi-jurisdiction breaches systematically.

What Triggers the Notification Duty

Before working through jurisdiction-specific timelines, understand that most breach notification laws are triggered by risk to affected individuals — not by the breach itself. A breach of a fully encrypted file where the encryption keys were not compromised typically does not trigger notification (because the data cannot be used even if accessed). A breach of a dataset where individuals face a real risk of identity theft, financial fraud, or physical harm does.

Common trigger tests:

• GDPR (EU/UK): Notification to the supervisory authority is required when a breach is “likely to result in a risk to the rights and freedoms of natural persons.” Notification to affected individuals is required when the risk is “high.” The assessment must be documented even when you decide not to notify.
• HIPAA (US healthcare): Notification is required unless the covered entity can demonstrate a low probability that PHI was compromised, assessed against four factors: the nature and extent of the PHI involved, the unauthorised person who used it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated.
• US state laws generally: Most state laws require notification when there is a reasonable belief that personal information was acquired by an unauthorised person and the acquisition creates a real risk of harm.
• Australia NDB scheme: Notification is required when there is unauthorised access to or disclosure of personal information, and a reasonable person would conclude the breach is likely to result in “serious harm” to affected individuals.

Encrypted data is the most important exception. If personal data was encrypted with a current encryption standard and the encryption keys were not compromised, most breach notification laws — including GDPR, HIPAA, and most US state laws — do not require notification. Document this assessment carefully. You must be certain no data was exfiltrated before relying on the encryption exception.

Country-by-Country Notification Requirements

European Union — GDPR

Authority notification deadline: 72 hours from becoming aware of the breach.

Individual notification: Without undue delay when the breach is likely to result in high risk to individuals.

Triggering threshold: Risk to the rights and freedoms of natural persons. Not every breach — but the bar is not high. Loss of an unencrypted laptop with customer records, a phishing attack that exposes email addresses, or a ransomware attack that makes data temporarily unavailable but involves suspected exfiltration all typically trigger notification.

Who notifies: The data controller (your business). If you are a processor (handling data on behalf of a controller), you must notify the controller without undue delay — and the controller notifies the authority.

Where to notify: The lead supervisory authority — the DPA in the EU member state where your main establishment is located, or where affected individuals are based if you have no EU establishment.

What to include in authority notification: Nature of the breach, categories and approximate number of individuals affected, categories and approximate number of records affected, name of your DPO (if applicable), likely consequences of the breach, measures taken or proposed to address it.

Partial notification permitted: You can notify within 72 hours with the information available and provide more information in stages. “We are aware of a breach and are investigating — here is what we know so far” satisfies the 72-hour requirement if the investigation is genuinely ongoing.

Penalty for late notification: Article 83(4) — up to €10 million or 2% of global annual turnover, whichever is higher. Late notification is penalised independently of the underlying breach.

Key point for SMBs: The 72-hour window cannot be extended. If you don’t have a documented breach response process that includes a notification workflow to the relevant DPA, you will miss this deadline during the chaos of an actual incident.

United Kingdom — UK GDPR / ICO

Authority notification deadline: 72 hours from becoming aware of the breach — same as EU GDPR.

Individual notification: Without undue delay when high risk to individuals.

Who to notify: The Information Commissioner’s Office (ICO). Report via ico.org.uk/report-a-breach.

Triggering threshold: Same risk-based assessment as EU GDPR.

Penalty for late notification: ICO can fine up to £17.5 million or 4% of global annual turnover under UK GDPR.

2026 note: The UK Data (Use and Access) Act 2025 increased the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover for unlawful electronic marketing. PECR breach notification requirements (for public electronic communications providers) are separate from UK GDPR breach notification.

United States — Federal and Sector-Specific

The US has no federal general data breach notification law. Notification obligations come from three sources: federal sector-specific laws, the FTC’s oversight of unfair and deceptive practices, and individual state laws.

HIPAA (Healthcare):

• Notification to affected individuals: within 60 days of discovery
• Notification to HHS: within 60 days of discovery (breaches affecting fewer than 500 individuals are reported to HHS annually)
• Notification to prominent media outlets: required for breaches affecting 500 or more residents of a state
• Triggering threshold: Breach of unsecured PHI that fails the four-factor low-probability-of-compromise assessment

FTC Safeguards Rule (Financial institutions):

• Notification to customers: no federal timeline specified in the rule itself; state laws fill this gap
• Notification to the FTC: required for breaches affecting 500 or more customers; must be reported within 30 days of discovery (rule effective May 2024)

SEC Cybersecurity Disclosure Rules (Public companies):

• Material cybersecurity incidents must be reported on Form 8-K within four business days of determining the incident is material
• Annual disclosure of cybersecurity risk management practices required
• Applies to SEC-reporting companies — most small businesses are not affected

PCI DSS (Payment card data):

• Notify your acquiring bank immediately upon discovery
• Forensic investigation (PFI) typically required; timeline set by card brand and bank
• Notification to card brands (Visa, Mastercard) within 24 hours of suspected breach in some frameworks

United States — State Laws

All 50 US states have data breach notification laws. Requirements vary significantly. The table below covers key states; for a comprehensive state-by-state analysis, consult a privacy attorney or a current multi-state breach notification guide.

Critical 2026 change — California SB 446: California previously required notification “in the most expedient time possible and without unreasonable delay.” SB 446, effective January 1, 2026, replaced this with a specific 30-calendar-day deadline from discovery. This is the most significant US state breach notification change in 2026 and affects any business with California customers.

Multi-state obligation: If your breach affects individuals in multiple states, you must comply with each affected state’s law for those residents. You do not get to apply only the most lenient state’s requirements to all affected individuals.

Canada — PIPEDA / Bill C-27 (Consumer Privacy Protection Act)

Current law (PIPEDA):

• Notification to the Privacy Commissioner of Canada: when the breach creates a real risk of significant harm to individuals; “as soon as feasible” after determining the real risk
• Notification to affected individuals: at the same time or as soon as feasible after notifying the Commissioner
• No fixed numeric deadline — “as soon as feasible” is the standard

What the Commissioner expects: The OPC guidance describes “as soon as feasible” as requiring organizations to act quickly once the risk assessment is complete. Lengthy assessment periods without notification are scrutinised.

Bill C-27 (Consumer Privacy Protection Act): Passed the House of Commons and proceeded through Senate consideration. As of August 2026, Bill C-27 has not received Royal Assent. If enacted, it would modernise Canada’s private-sector privacy law, though specific breach notification timelines remain subject to legislative development. Monitor the status of C-27 if your business has significant Canadian operations.

Provincial laws: Quebec’s Law 25 (Act 25, in effect since September 2022 with phased implementation) applies to organisations doing business in Quebec. Quebec requires notification to the Commission d’accès à l’information (CAI) within 72 hours of learning of a confidentiality incident that presents a risk of serious injury.

Key point: Quebec’s 72-hour requirement is stricter than PIPEDA’s “as soon as feasible” standard. Businesses with Quebec customers should plan to meet the 72-hour timeline.

Australia — Privacy Act 1988 / Notifiable Data Breaches Scheme

Who must comply: APP entities — Australian Government agencies and private sector organisations with annual turnover over AUD $3 million, plus specific categories (private health service providers, credit reporting bodies, credit providers, businesses that trade in personal information) regardless of turnover.

Small business exemption: Currently, businesses with annual turnover of AUD $3 million or less are exempt from the NDB scheme in most cases. This exemption may be removed in future privacy reform tranches — not yet law as of August 2026.

Timeline:

• Assessment: 30 days from becoming aware of a possible eligible breach to assess whether it is notifiable
• Notification to OAIC and affected individuals: “as soon as practicable” after completing the assessment

Triggering threshold: Unauthorised access to or disclosure of personal information that a reasonable person would conclude is likely to result in “serious harm” to affected individuals.

Separate ransomware payment reporting (Cyber Security Act 2024, effective May 2025): Businesses with annual turnover over AUD $3 million that make a ransomware payment (or become aware that a payment has been made on their behalf) must report to the Australian Signals Directorate (ASD) within 72 hours. This is separate from the NDB scheme and is triggered by payment of a ransom, not by the breach itself.

Proposed 72-hour reform: The Australian Government agreed in principle (as part of the Privacy Act review) to reduce the authority notification timeline to 72 hours. This reform has not yet been enacted in legislation as of August 2026.

Penalties: Up to AUD $50 million, or three times the benefit obtained, or 30% of adjusted turnover (whichever is greater) for serious or repeated privacy interferences.

Singapore — Personal Data Protection Act (PDPA)

Authority notification deadline: 3 calendar days (72 hours) from the date the organisation assesses the breach to be notifiable, or from the date the organisation should reasonably have known.

Individual notification: “As soon as reasonably practicable” — typically within 30 days.

Who to notify: Personal Data Protection Commission (PDPC).

Triggering threshold: Breach that results in, or is likely to result in, significant harm or impact to affected individuals. Also mandatory notification when 500 or more individuals are affected, regardless of harm assessment.

Key detail: The 3-day clock runs from the date of assessment, not from first discovery — giving organisations time to assess before the clock starts.

Brazil — LGPD (Lei Geral de Proteção de Dados)

Authority notification deadline: “Within a reasonable period” — Brazilian guidance suggests 2 working days, though the ANPD (Autoridade Nacional de Proteção de Dados) has indicated 2 days is a target rather than a hard statutory deadline.

Individual notification: Required when notification is relevant to affected individuals, without undue delay.

Who to notify: ANPD.

Triggering threshold: Breach that may cause risk or damage to data subjects.

Japan — Act on the Protection of Personal Information (APPI)

Authority notification deadline: Promptly, within 30 days from discovery (within 60 days for cases involving the possibility of leakage by a third party with malicious intent). Prompt notification to the Personal Information Protection Commission (PPC) is required.

Individual notification: Promptly, within 30 days.

Triggering threshold: Specific categories of leakage require notification (leakage of special care required information, cases potentially leading to improper profit-seeking, leakage involving 1,000+ individuals, leakage involving systematic provision to a third party without a specific purpose).

India — Digital Personal Data Protection Act (DPDPA)

As of August 2026, India’s DPDPA has been enacted but its breach notification provisions are not yet in force. The government is developing implementing rules, with enforcement expected around May 2027. When enforcement commences, notification to the Data Protection Board of India is expected to be required as soon as practicable. Monitor official guidance from the Ministry of Electronics and Information Technology (MeitY).

Quick Reference: Breach Notification Timelines by Jurisdiction (2026)

This table represents the general framework as of August 2026. Consult a qualified privacy attorney for jurisdiction-specific advice on any active breach.

The Multi-Jurisdiction Decision Framework

When a breach occurs, work through this framework to identify your notification obligations:

Step 1: Identify where affected individuals are located

Map the personal data involved to the jurisdictions of the affected individuals — not where your business is, but where they are. This may require examining the breached dataset to understand customer geography. If you cannot determine exact geography, use conservative assumptions (if it’s possible California residents are affected and you have California customers, assume they are).

Step 2: Identify what type of data was involved

Healthcare data triggers HIPAA in the US regardless of which state the individuals are in. Payment card data triggers PCI DSS notification requirements. Financial account data triggers FTC Safeguards Rule considerations. Generic personal data (names, email addresses) triggers the applicable general data protection laws. Special categories of sensitive data (health, racial/ethnic origin, financial accounts, precise geolocation) typically carry stricter thresholds and heightened obligations.

Step 3: Assess whether the triggering threshold is met

Apply the risk assessment for each relevant jurisdiction:

• GDPR/UK GDPR: Is there a “risk to the rights and freedoms” of affected individuals?
• HIPAA: Does the breach fail the four-factor low-probability-of-compromise test?
• US state laws: Is there a real risk of harm (identity theft, financial fraud)?
• Australia NDB: Would a reasonable person conclude the breach is likely to result in serious harm?

Document your assessment. If you decide not to notify in a jurisdiction, document why the threshold isn’t met. This documentation protects you if the decision is later questioned.

Step 4: Identify the shortest deadline and work backward

Once you’ve determined which jurisdictions require notification, identify the shortest applicable deadline. In most multi-jurisdiction breach scenarios for businesses with EU or UK customers, the GDPR/UK GDPR 72-hour deadline to the supervisory authority is the most urgent.

Work backward from that deadline to identify what must happen in the first 48 hours:

• Hour 0–12: Confirm the nature and scope of the breach
• Hour 12–24: Assess which jurisdictions are affected
• Hour 24–36: Prepare the initial authority notification (GDPR 72-hour notice can be partial)
• Hour 36–72: Submit authority notification; begin preparing individual notifications

Step 5: Notify in parallel, not in sequence

You cannot notify the EU authority first, then figure out California, then deal with HIPAA. All notification obligations with overlapping deadlines must run in parallel. For most small businesses, this means either having a breach response firm or privacy attorney on retainer who can manage the multi-jurisdiction process simultaneously, or having pre-built notification templates for each jurisdiction you regularly deal with.

Step 6: Document everything

Every assessment, every decision, every communication — documented with timestamps. This documentation is what demonstrates compliance if regulators investigate. It is also what tells you what happened during the post-incident review.

Building Your Breach Notification Process Before You Need It

The single most important thing this article can convey is that breach notification processes must be built before a breach, not during one.

When ransomware is running at 2am, when a phishing attack has exposed customer records, when an employee’s laptop has been stolen — that is not the moment to read this article and figure out who to call. By then, the 72-hour clock has already started.

Before a breach happens, do the following:

Identify your jurisdictions. List every country and US state where you have customers whose data you process. Research the notification requirements for each. Create a one-page reference document listing the authority to notify, the deadline, and the notification method for each relevant jurisdiction. Bookmark each notification portal.

Create notification templates. GDPR authority notifications have a defined format that the ICO, the CNIL, and other DPAs expect. HIPAA HHS notifications have a specific format. California AG notifications have standard content requirements. Pre-draft these templates with the fields you’ll need to complete during an actual breach, leaving blanks for the breach-specific details.

Appoint a breach response lead. Name the person who owns the notification process during an incident. This person is responsible for tracking notification deadlines, coordinating with legal counsel, drafting notifications, and submitting them. For a small business, this is typically the owner, the senior operations person, or a retained privacy attorney.

Retain incident response support. For businesses above a modest threshold of data sensitivity (any healthcare data, any payment card data, any significant volume of EU or California customers), retain a breach response firm or privacy attorney before an incident. The cost of a retainer is a fraction of the cost of managing a multi-jurisdiction breach response without expertise.

Test your process. Run a brief tabletop exercise annually: “We just discovered that our CRM database was accessed by an unauthorised party. What do we do in the next 24 hours?” Walk through the steps. Identify gaps. Fix them before the real scenario.

What to Avoid

Don’t wait until your investigation is complete to notify. The GDPR 72-hour clock does not pause while you investigate. The initial notification can be provisional — “We are aware of a potential breach and are investigating; here is what we know so far” satisfies the requirement. Submitting a partial notification on time and updating it as more information becomes available is both legally acceptable and expected.

Don’t assume the encryption exception applies without verifying. If data was encrypted and the encryption key was not compromised, notification may not be required. But this assessment requires certainty: verified that the key was not accessed, verified that the encryption standard is current, and documented the assessment. If ransomware encrypted your systems but you are uncertain whether data was exfiltrated first, the encryption exception does not apply.

Don’t apply the law of the state where your business is located. US state breach notification laws are triggered by the residence of the affected individuals, not by where your business operates. A New York-based business that has a breach affecting California residents must comply with California’s 30-day notification deadline for those California residents.

Don’t confuse your IT provider’s timeline with your legal timeline. Your IT provider may tell you they need 10 days to complete the forensic investigation. Your legal obligation to notify may be 72 hours. These are independent. You can notify the authority within 72 hours with what you know while the investigation continues.

Don’t ignore lower-volume breaches. A breach affecting 50 people still triggers notification obligations in most jurisdictions if the data involved creates a real risk of harm. The scale of a breach does not determine whether notification is required — the risk to affected individuals does.

Final Verdict

Data breach notification is a legal sprint that runs simultaneously with an IT crisis. The businesses that manage it well in 2026 are not necessarily the ones with the most sophisticated security — they’re the ones that built the notification process before they needed it.

For any small business handling personal data across multiple jurisdictions:

• Know your jurisdictions and their deadlines before a breach
• Build notification templates for each jurisdiction in advance
• Appoint a named breach response lead
• Retain a privacy attorney or breach response firm capable of multi-jurisdiction management
• Run the 72-hour scenario as a tabletop exercise annually

The most common data breach notification failure is not a malicious decision to hide a breach. It’s a business that didn’t know the clock had started, didn’t know which regulator to call, and didn’t have a template ready. By the time they figured all of this out, the 72-hour deadline had passed.

Build the process now, while you have time to do it right.

Frequently Asked Questions

When does the breach notification clock start?

In most jurisdictions, the clock starts when you become aware — or when reasonable diligence would have revealed — that a breach has occurred. You do not need to know all the details of the breach for the clock to start. Under GDPR, the 72-hour clock begins when you have “a reasonable degree of certainty that a security incident has occurred.” Under HIPAA, discovery occurs on the first day a workforce member knew or should have known of the breach. Ignorance caused by failing to investigate suspicious activity does not pause the clock — if a reasonable investigation would have revealed the breach, the timeline runs from when that investigation should have been completed.

Do I have to notify individuals in every jurisdiction?

Not always. Most breach notification laws require individual notification only when the breach creates a real risk of harm to affected individuals. Low-risk breaches — for example, brief unauthorised access to non-sensitive contact information where there is no evidence of misuse — may not trigger individual notification obligations even if authority notification is required. Always make a documented risk assessment for each jurisdiction. However, when in doubt, err toward notification. The legal exposure from failing to notify individuals who were then harmed typically exceeds the cost of notifying individuals in cases where notification wasn’t strictly required.

What if I can’t identify exactly which individuals were affected?

You must notify using the best information available. Many breaches involve compromised databases where exact attribution to specific individuals is uncertain. In this situation, notify all individuals who could reasonably have been affected. If you genuinely cannot identify specific individuals, some jurisdictions allow “substitute notice” — posting a prominent notice on your website. Consult the specific jurisdiction’s rules on substitute notice, as requirements vary.

Can my IT provider or cloud service handle breach notification for me?

Your cloud provider or IT provider may assist with technical aspects of breach investigation, but legal notification obligations are yours. Under GDPR, if you are a data controller, you must notify the supervisory authority — your processor (cloud provider) must notify you of the breach as soon as possible, but the regulatory notification obligation belongs to you. If you are a HIPAA covered entity, you are responsible for notifying HHS and affected individuals regardless of whether a business associate’s system was compromised. Contractual obligations to notify you promptly are the mechanism by which you receive the information needed to meet your regulatory obligations — they don’t transfer the obligation itself.

What is “substitute notice” and when can I use it?

Substitute notice is a method of notifying affected individuals when direct individual notification is not practical or when the cost of direct notification would be excessive. Most US state laws permit substitute notice when the business doesn’t have sufficient contact information for affected individuals, or when notifying each individual would cost more than a specified threshold. Substitute notice typically involves posting a prominent notice on the business’s website and, in some states, notifying major statewide media outlets. The specific requirements for substitute notice — including what makes it available and what form it must take — vary by state. Substitute notice is not a general replacement for individual notification when contact information is available.

This article provides general educational information. Breach notification requirements are jurisdiction-specific, sector-specific, and subject to change. This article reflects requirements as understood as of August 2026. Businesses experiencing an active breach should contact a qualified privacy attorney immediately. For official guidance: EU/EEA — EDPB guidelines; UK — ICO breach reporting; USA/HIPAA — HHS breach notification; Australia — OAIC NDB scheme.

Related reading on SmallBiz Defense:

• GDPR Compliance Checklist for Small Business Owners (2026)
• HIPAA Cybersecurity Requirements for Small Healthcare Businesses (2026)
• How to Write a Cybersecurity Policy for Your Small Business (2026)