Cyber Incident Response and Breach Notification Law

Cyber incident response and breach notification law requires organizations to detect, respond to, and report security incidents that compromise personal data or critical systems. The regulatory landscape has converged on mandatory notification with specific deadlines, moving away from the earlier voluntary disclosure model. The GDPR (Articles 33 and 34) requires notification to the supervisory authority within 72 hours and to affected data subjects without undue delay for high-risk breaches. The EU NIS2 Directive (2022) extends notification obligations to critical infrastructure operators with a 24-hour early warning, 72-hour incident notification, and 1-month final report timeline. In the US, the SEC's 2023 rule requires public companies to disclose material cybersecurity incidents within 4 business days, state breach notification laws (all 50 states) impose varying deadlines (typically 30–90 days), and the HIPAA Breach Notification Rule requires notification within 60 days for health data. India's Digital Personal Data Protection Act (DPDP, 2023) requires notification within 72 hours to the Data Protection Board.

The framework imposes two distinct obligations. The first is operational response — the organization must detect, contain, eradicate, and recover from the incident, preserving forensic evidence and maintaining business continuity. The second is notification — the organization must inform regulators, affected individuals, and sometimes the public, with specific content and timing requirements. Failure to meet notification obligations can result in substantial penalties (GDPR fines up to €10 million or 2% of global turnover) and, in some jurisdictions, private rights of action.

This page covers GDPR notification requirements, US notification obligations, sectoral laws (NIS2, HIPAA, GLBA), the incident response framework, and practical compliance.

Article 33 of the GDPR requires organizations to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it. A "personal data breach" is broadly defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. The notification must describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. If the notification is not made within 72 hours, it must be accompanied by reasons for the delay. An exception applies where the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" — in which case notification is not required.

Article 34 requires notification to the affected data subjects without undue delay when the breach is "likely to result in a high risk to the rights and freedoms of natural persons." The notification must describe the nature of the breach, the name and contact details of the data protection officer or other contact, the likely consequences, and the measures taken. It must be in clear and plain language. Exceptions apply where appropriate technical and organizational protection measures rendered the data unintelligible (e.g., encryption), where subsequent measures ensure the high risk is no longer likely to materialize, or where notification would involve disproportionate effort (in which case a public communication replaces individual notice).

Article 33(5) requires organizations to document all personal data breaches — including facts, effects, and remedial action — regardless of whether notification was required. This documentation is the basis for the "unlikely to result in a risk" assessment and is subject to supervisory authority review. The documentation obligation means that organizations must have internal breach recording processes even for minor incidents that do not trigger notification.

The US SEC's 2023 rule (Item 1.05 of Form 8-K) requires public companies to disclose material cybersecurity incidents within 4 business days of determining materiality. "Materiality" depends on the significance of the incident to a reasonable investor, considering quantitative and qualitative factors. The disclosure must describe the material aspects of the nature, scope, and timing of the incident and its material impact (or likely material impact) on the registrant. The SEC has emphasized that companies should not delay materiality determinations unnecessarily.

All 50 US states have breach notification laws, creating a patchwork of requirements. Most require notification to affected residents without undue delay, with specific deadlines ranging from 30 to 90 days depending on the state. Some states require notification to the state attorney general above certain thresholds. The definitions of "personal information" triggering notification vary (some include biometric data, some include email credentials, some include health insurance information). The strictest applicable state law effectively governs national operations for companies that cannot segment affected residents by state.

The HIPAA Breach Notification Rule (45 CFR §§164.400-414) requires covered entities and business associates to notify affected individuals within 60 days of discovering a breach of unsecured protected health information (PHI). For breaches affecting 500 or more residents of a state or jurisdiction, notification to media and the HHS Secretary is also required within 60 days. Smaller breaches (under 500) must be logged and reported to HHS annually. The "unsecured PHI" standard means that breaches of data encrypted or otherwise rendered unusable may not trigger notification, provided the encryption key was not also compromised.

The four-factor risk assessment for HIPAA notification considers: (1) the nature and extent of the PHI involved, (2) the unauthorized person who used or received the PHI, (3) whether the PHI was actually acquired or viewed, and (4) the extent to which the risk has been mitigated.

The EU NIS2 Directive (2022, transposition deadline October 2024) significantly expands incident reporting obligations for critical infrastructure operators ("essential" and "important" entities across sectors including energy, transport, banking, health, digital infrastructure, and public administration). The reporting timeline is layered: an "early warning" within 24 hours of detecting a significant incident, an "incident notification" within 72 hours, and a "final report" within 1 month. NIS2 applies to a broader range of entities than its predecessor (NIS1) and introduces personal liability for management for failure to comply with incident reporting obligations.

The US Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to notify the Federal Trade Commission (FTC) and appropriate regulators of security incidents involving customer information. The 2021 amendments added specific notification requirements: notice to the FTC as soon as possible, and no later than 30 days after discovery, for incidents affecting 500 or more consumers. State regulators may have additional requirements for financial institutions under their jurisdiction.

India's Digital Personal Data Protection Act (DPDP, 2023) requires data fiduciaries to notify the Data Protection Board and affected data subjects of a personal data breach. The Act specifies a 72-hour notification deadline to the Board, though implementing rules may refine the specific content and process. The DPDP applies to personal data processed in India and to processing outside India that targets individuals in India, creating extraterritorial reach similar to the GDPR.

The NIST Incident Response framework (SP 800-61) defines a structured lifecycle: Preparation (establishing policies, tools, and training before an incident), Detection and Analysis (identifying incidents through monitoring and reporting), Containment, Eradication, and Recovery (limiting damage, removing the cause, and restoring systems), and Post-Incident Activity (lessons learned and improvement). The SANS Institute's framework is similar: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Both frameworks emphasize that incident response is a continuous process, not a one-time reaction.

An incident response plan is a legal and operational necessity. The plan should define roles and responsibilities (incident commander, technical lead, communications lead, legal counsel, forensics), contact information and escalation procedures, communication protocols (internal, external, regulatory, and public), legal and forensic coordination (including attorney-client privilege considerations), and insurance notification. The plan should be tested annually through tabletop exercises or simulations, as untested plans frequently fail under real incident pressure.

Digital forensics plays a critical role in incident response and legal compliance. Preserving evidence (creating forensic images, maintaining chain of custody), collecting and analyzing artifacts, and producing defensible findings support both notification decisions and potential litigation. A legal hold — formally suspending routine data destruction to preserve relevant evidence — should be issued early in the response process. Forensic findings may also be required by regulators or law enforcement as part of their investigation.

Organizations should build incident response and breach notification capability around four pillars. First, have a tested incident response plan: develop a plan based on the NIST or SANS framework, define roles and contacts, establish escalation and communication procedures, coordinate legal and forensic resources, and test the plan annually through exercises. Without a tested plan, the 72-hour GDPR deadline and other notification timelines are extremely difficult to meet.

Second, detect and assess incidents: deploy monitoring (SIEM, SOC, threat intelligence) to detect incidents promptly, and establish processes to assess scope, impact, risk to individuals, and whether personal data is involved. The assessment determines which notification obligations are triggered — a breach unlikely to risk individuals may not require GDPR notification, while a high-risk breach triggers both authority and data subject notification.

Third, notify within applicable deadlines: identify all applicable notification obligations (GDPR 72 hours to authority, GDPR Article 34 to data subjects for high-risk, SEC 4 business days for material, HIPAA 60 days, NIS2 24/72 hours, state laws, DPDP 72 hours) and prepare notification templates in advance. Document all notifications and the reasoning behind them, including decisions not to notify where the risk assessment supports that conclusion.

Fourth, recover and learn: contain and eradicate the incident, restore systems from verified backups, conduct lessons-learned reviews, and update the incident response plan based on what worked and what did not. Coordinate with legal counsel (for privilege) and insurance (for coverage) throughout. The lessons-learned phase is where future incidents are prevented — without it, the same vulnerabilities persist.