Data Breach Notification Deadlines by Country (2026 Comparison Table)

Quick answer

There is no worldwide breach-notification deadline. The European Union's GDPR set the benchmark most other laws are compared against: notify the regulator within 72 hours of becoming aware of a breach, and notify affected individuals "without undue delay" only if the breach poses a high risk to their rights.

Many countries copy the 72-hour number for their own regulator-notice leg (South Korea, the Philippines, Indonesia, Saudi Arabia's implementing regulation, Turkey, Kenya, Nigeria, Uruguay, and several UAE free zones). Just as many do not: Switzerland, South Africa, Canada, New Zealand's statute, Chile, Germany's telecom-sector rule, and most Latin American civil-law countries use open-ended language such as "without undue delay," "as soon as feasible," or "as soon as practicable" instead of a fixed hour count.

A handful of jurisdictions have no breach-notification law at all in practical terms right now: Hong Kong (voluntary), Argentina (no legal duty), and India's data-protection-specific duty (enacted but not yet in force). The tables below give the two deadlines separately for every jurisdiction we could verify, and say so plainly wherever a fixed number does not exist.

How to read this table

Every row below is split into two columns on purpose: the deadline to notify the regulator and the deadline to notify affected individuals. These are frequently different clocks, with different triggers, and conflating them is the most common mistake in breach-notification coverage. GDPR is the clearest example: the regulator-notice trigger is any breach that carries some risk, while the individual-notice trigger requires high risk, a meaningfully higher bar, and the individual leg carries no fixed hour figure at all.

"No fixed deadline" is a real, correctly-researched answer, not a gap in this table. Where a jurisdiction's law says "as soon as possible" or "without undue delay" with no accompanying number, we say so rather than borrowing a number from a different country's law or from regulator guidance that was never written into the statute.

We also flag, wherever it matters, whether a deadline lives in the primary statute, in a subordinate regulation, or only in non-binding guidance, and whether a deadline that has been enacted is actually in force yet. Those three distinctions change how much weight a compliance team should put on a number, and most secondary sources collapse them into a single "X hours" headline that erases the distinction entirely.

The GDPR 72-hour anchor, briefly

The EU/EEA baseline comes from the General Data Protection Regulation, Articles 33 and 34. A controller must notify its competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware" of a breach, unless the breach is unlikely to result in any risk to individuals' rights and freedoms. Notice to the affected individuals themselves is required only where the breach is likely to result in a high risk, and that leg carries no fixed hour figure, only "without undue delay."

That two-tier structure, a lower bar and a fixed clock for the regulator, a higher bar and no fixed clock for individuals, is the design pattern most of the rest of the world either copies or deliberately diverges from. For the full walkthrough of GDPR's own text, exemptions, and enforcement history, see our GDPR 72-hour breach notification rule deep dive.

Europe

The EU/EEA states share one legal text (GDPR), so the real variation in Europe comes from EEA-EFTA states that apply GDPR through separate national incorporation, non-EU states like Switzerland and the UK that have their own post-GDPR statutes, and sector-specific overlays that impose shorter, separate clocks. EU adequacy decisions also shape how breach data can move across these borders in the first place.

Asia-Pacific

Asia-Pacific splits roughly into three groups: jurisdictions that copy the GDPR-style 72-hour regulator clock (South Korea, the Philippines, Indonesia, Malaysia), jurisdictions with day-based or assessment-based deadlines (Japan, Singapore, Australia), and jurisdictions with no fixed number at all (New Zealand's statute, Hong Kong, current-law Taiwan).

Middle East and Africa

This region has the widest gap between what compliance blogs report and what the underlying legal instrument actually says. Several "72-hour" figures here live only in guidance or a sub-statutory regulation, not the primary law, and at least two jurisdictions (South Africa, Morocco) deliberately set no numeric deadline at all.

The Americas

Latin America's civil-law data-protection statutes mostly use open-ended language for the primary law, with fixed numeric clocks appearing in implementing regulations, decrees, or resolutions, a level below the law itself. Two structural outliers, Argentina (no legal duty) and Chile (a genuine two-law misattribution), are the region's most-quoted mistakes.

Common misconceptions

"Chile is 72 hours." No. Chile's data-protection law, 21.719, sets no fixed hour at all for breach notification, only "the most expeditious means possible, without undue delay." The 72-hour figure that gets attached to Chile everywhere actually belongs to a separate statute, the Cybersecurity Framework Law (21.663), which governs cyberattacks against essential services reported to a different regulator, CSIRT Nacional, not general personal-data breaches. Treating these as the same law is the single most-repeated Chile error.

"Germany's telecom rule is 24 hours." Half right, and the wrong half is the sourcing, not the number. Section 169 of the Telecommunications Act (TKG) uses only "unverzuglich," without undue delay, with no numeric figure anywhere in the statute text, so a provider that reads only the TKG will not find 24 hours there. But the 24 hours is real and binding: Regulation (EU) No 611/2013, Article 2(2), applies directly in every member state, Germany included, to providers of publicly available electronic communications services, and requires notice to the competent national authority "no later than 24 hours after the detection of the personal data breach, where feasible." The error is attributing the figure to the TKG, not the figure itself.

"Ecuador is 72 hours to the regulator, 3 days to individuals" or "3 days to the regulator." Both common phrasings get it backwards or conflate the legs. Ecuador's LOPDP sets 5 business days to the Superintendencia and ARCOTEL (Art. 43), and a shorter 3-business-day clock to the individual (Art. 46), the opposite of the regulator-then-individual ordering most breach laws use.

"Everyone uses 72 hours." No. A meaningful share of the jurisdictions in this matrix set no fixed hour figure at all for at least one leg: South Africa, Switzerland, Canada, New Zealand's own statute (the 72 hours you'll see cited is Privacy Commissioner guidance, not the Act), Morocco, Ghana, DIFC, Israel, and Chile's data-protection law all use open-ended standards like "as soon as reasonably possible" or "without undue delay" instead.

Guidance is not statute. The UAE's federal 72-hour figure is Data Office operational guidance; the Executive Regulations that would codify a number were never formally issued. New Zealand's 72 hours is the Privacy Commissioner's own guide, explicitly labeled "a guide only." Quebec's 72 hours is CAI/industry shorthand for a statute that actually just says "promptly."

Enacted is not in force. Taiwan's 72-hour authority-notice clock exists only in a December 2025 amendment awaiting subsidiary regulations and a commencement order; today's operative Taiwanese law has no authority-notice deadline whatsoever. India's DPDP breach-notification duty is enacted but does not commence until roughly 13 May 2027. Egypt's Executive Regulations took effect 1 November 2025 but carry a one-year grace period to 31 October 2026.

Hong Kong has no legal deadline, because it has no legal requirement. Breach notification in Hong Kong is entirely voluntary under the PDPO; the Privacy Commissioner's guidance recommending prompt notice is non-binding.

Argentina has no breach-notification obligation at all. Law 25.326 contains a general security duty but no breach-notice article. The AAIP's 72-hour recommendation is exactly that, a recommendation, not a legal requirement.

Kuwait: no number should be published. Reputable secondary sources directly conflict between 24 hours and 72 hours for the same regulation (Regulation No. 26 of 2024, Art. 4(15)), and the regulation is scope-limited to CITRA-licensed telecom and IT providers, not an economy-wide law.

Sector overlays: rules that stack on top of the general law

Several regimes impose their own, often shorter, breach or incident clocks on specific sectors, layered on top of (not instead of) the general data-protection deadline that already applies.

• NIS2 Directive (EU 2022/2555), Art. 23. applies to "essential" and "important" entities: critical infrastructure, digital infrastructure, healthcare, energy, and similar sectors, not general controllers. A three-stage cascade: an early warning within 24 hours, a full incident notification within 72 hours, and a final report within one month.
• DORA (EU 2022/2554), Art. 20 and its implementing technical standards. applies to the financial sector: banks, insurers, investment firms, and critical ICT third-party providers. Confirmed directly from the Regulatory Technical Standards: an initial report within 4 hours of classifying an incident as major (and in any case within 24 hours of becoming aware), an intermediate report within 72 hours, and a final report within one month.
• eIDAS Regulation (EU 910/2014), Art. 19(2). trust service providers (e-signature, e-seal, website-authentication providers) must notify their national supervisory body within 24 hours, separate from the 72-hour GDPR route, and this duty also applies in the UK via its retained eIDAS regime.
• EU ePrivacy sector regulation (611/2013). public electronic-communications providers across the EU notify their national telecoms regulator within 24 hours where feasible, the EU-wide rule underneath Germany's TKG example above.
• HIPAA (US health data), 45 CFR Sec. 164.404. covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals also require notifying HHS and, in many cases, prominent local media, on the same 60-day clock; smaller breaches are logged and reported to HHS annually.
• SEC, Item 1.05 of Form 8-K (US public companies). discloses a material cybersecurity incident within 4 business days of determining materiality, not from discovery of the incident itself. The clock starts at the materiality determination, which itself must be made "without unreasonable delay."
• CERT versus DPA divergence, the sharpest example anywhere in this matrix: India. CERT-In's 6-hour cybersecurity-incident rule is live and binding today. The DPDP Act's data-protection-specific breach duty, with its own "without delay" plus 72-hour Board report, is enacted but does not commence until roughly 13 May 2027. An Indian company facing a breach right now is bound by the 6-hour CERT-In clock, not by any DPDP number, no matter how often "India's breach deadline" gets reported as 72 hours.

United States: state-by-state summary

There is no single federal data-breach-notification law in the US. All 50 states, DC, and the US territories have their own statutes, and the site maintains a full page for each at /us-laws/data-privacy-laws/{state}-data-privacy-laws/data-breach-notification/. This section summarizes the pattern rather than repeating 51 rows.

The most common standard is not a fixed number. Most states use a "without unreasonable delay" or "most expedient time possible" standard, sometimes paired with an outer-bound backstop number.

Where states do set a numeric outer bound, it clusters in the 30-45-60 day range. Washington requires notice within 30 calendar days (RCW 19.255.010), and Florida sets the same 30-day figure with one 15-day extension available for good cause, making the practical ceiling 45 days. Colorado also uses 30 days, with a lower 500-resident threshold for AG notice and a separate 1,000-resident threshold for notifying nationwide consumer-reporting agencies.

Texas is the outlier worth naming specifically, because it does not fit the pattern most aggregators assume. Texas gives individuals 60 days to be notified, but requires notice to the Texas Attorney General within a much shorter 30 days when 250 or more Texas residents are affected, the AG clock, not the consumer clock, is the short one.

AG or regulator notification thresholds most commonly trigger at 500 residents (Florida, Washington, and many others) or 1,000 residents (used both as an independent AG-notice trigger in some states and as a separate consumer-reporting-agency trigger in Colorado).

Federal sectoral rules fill some of the gap where no general federal law exists: HIPAA's 60-day rule for health data and the SEC's 4-business-day rule for public companies (both detailed above), plus the FTC Safeguards Rule, which requires non-banking financial institutions to notify the FTC, not consumers, within 30 days of discovering a breach affecting 500 or more consumers' unencrypted information. That FTC rule is regulator-facing only; consumer notice still depends on the applicable state law.

Practical compliance guidance

Identify both legs separately, for every jurisdiction where you operate. A breach-response plan that tracks only "the deadline" for a country, rather than the regulator deadline and the individual deadline as two distinct clocks with two distinct triggers, will misfire the moment those two clocks diverge, which is the norm, not the exception, across this matrix.

Start every jurisdiction's clock from "becoming aware," not from "confirmed." Most of the statutes above measure from when the controller became aware of, or had reasonable grounds to believe, a breach occurred, not from when the investigation concluded. Waiting for full certainty before starting the clock is one of the more common ways organizations blow a 72-hour deadline.

Check whether the number you are relying on is in the primary statute, a subordinate regulation, or guidance, and whether it has actually commenced. This matrix flags every instance where those three things diverge: Chile, Germany, the UAE, New Zealand, Quebec, Taiwan, India, and Egypt all have at least one commonly-cited figure that turns out to be guidance, a different law, or not yet in force.

Where a jurisdiction sets no fixed number, "as soon as possible" is still an enforceable standard, not an invitation to delay. Regulators in no-fixed-deadline jurisdictions, Switzerland's FDPIC and South Africa's Information Regulator among them, actively evaluate whether the delay itself was reasonable given the facts, even without a bright-line hour count to measure against.

Multinational breaches trigger the shortest applicable clock across every affected jurisdiction simultaneously. A breach touching EU, Indian, and US data subjects at once is bound by GDPR's 72 hours, CERT-In's 6 hours, and whichever US state and sector rules apply, concurrently, not sequentially. Build the response plan around the shortest clock in the mix, not the average.