Free Online Data Breach Notification Timeline

About the Data Breach Notification Timeline

When a personal data breach is discovered, several clocks may start at once. Under the GDPR, controllers generally must notify the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. The UK GDPR uses the same 72-hour framework. US state laws vary widely: some require notice within 30 days, some within 60 days, and some use a reasonableness standard or a different trigger. Contracts and sector rules can add their own periods. This tool turns the discovery moment and your selected rules into a shared timeline so the team can see which deadline comes first.

Enter the date and time the breach was discovered, choose the rules that apply, and adjust the configurable periods to match your legal advice. Each row shows the rule, the local deadline, the same deadline in UTC, the remaining time, and a status. Overdue rows turn red, and deadlines inside the next 24 hours turn amber. The earliest deadline is highlighted at the top. The timeline is calculated entirely in your browser and can be copied as plain text for an incident log or a message to counsel.

Why "discovery" is not always obvious

• Awareness: the clock usually starts when you have a reasonable degree of certainty that a security incident occurred and led to personal data being compromised, not when the first alert fired.
• Investigation: initial triage can be quick, but the notification decision still needs facts about the data, the people affected, and the risk.
• Processors: a processor that discovers a breach often must notify the controller without undue delay, which then starts or continues the controller's clock.
• Documentation: even a breach that is not notifiable should usually be recorded internally with the facts and the reasoning.

Using the timeline responsibly

This calculator only does arithmetic. It does not decide whether a breach is notifiable, which regulator or individuals must be told, what the notice must contain, or whether a delay is justified. Those decisions depend on the law, the data types, the number of people affected, encryption, containment, and the risk of harm. The 72-hour figure is a default, not a universal rule, and some jurisdictions require notice to individuals within a different period. Update the configurable fields to reflect the advice you receive, and keep a record of the discovery time and the source of each deadline.

A practical incident runbook should assign an owner for each deadline, prepare a notification template, and include contact details for regulators, insurers, and counsel before an incident occurs. The timeline shown here is an informational planning aid, not legal advice. If a real breach occurs, engage qualified counsel and follow your regulator's current guidance rather than relying on a web calculator.

Frequently asked questions