Who do we have to notify after a breach, and by when?

It depends on who you are and what was taken, but the clocks that catch most organisations are these: your cyber insurer, usually "promptly" and before you spend money; the SEC, within four business days of deciding a cyber incident is material, if you're a public company; the FTC, within 30 days of discovery, if you're a financial institution under the Safeguards Rule and 500 or more consumers' unencrypted data was taken; HHS and affected individuals, within 60 days, for health data under HIPAA; and your state's attorney general and residents under whichever state breach laws apply, which vary. Contracts with customers often add shorter deadlines than any law. None of this is legal advice, and counsel should run the list. But you should know the shape of it before the day you need it.

Start with the insurer and the contracts, not the regulators

The regulatory deadlines get the attention, but two things usually bite first. The policy will require notice to the carrier within a short window and may void coverage for costs incurred before you told them. And your customer contracts, especially with larger enterprises, often contain breach-notification clauses of 24 to 72 hours from discovery, regardless of what the law says. Pull both now and write the deadlines on one page. The incident is not the time to learn you had 48 hours and spent them investigating.

The federal clocks

SEC, public companies. Item 1.05 of Form 8-K requires disclosure within four business days of determining that a cybersecurity incident is material; the clock runs from the materiality determination, not from discovery, and the determination has to be made "without unreasonable delay" (U.S. Securities and Exchange Commission, 2023). The Division of Corporation Finance has since said that if you want to disclose an incident you haven't yet determined to be material, use Item 8.01 rather than 1.05, so that 1.05 filings mean what they say (Gerding, 2024). A delay is possible only if the Attorney General determines disclosure would pose a substantial risk to national security or public safety.

FTC, financial institutions under Safeguards. Notify the FTC as soon as possible and no later than 30 days after discovering a "notification event," meaning unauthorised acquisition of unencrypted customer information involving at least 500 consumers. Encrypted data counts as unencrypted if the key was accessed too (Federal Trade Commission, n.d.). The rule covers more businesses than the name suggests: mortgage brokers, auto dealers that finance, tax preparers, and others.

HHS and individuals, health data. Covered entities under HIPAA must notify affected individuals without unreasonable delay and no later than 60 days after discovery, notify HHS, and for breaches affecting 500 or more residents of a state, notify prominent media there as well (U.S. Department of Health and Human Services, n.d.).

CISA, critical infrastructure, once CIRCIA's final rule is in force. The rule will require covered entities to report substantial cyber incidents within 72 hours and ransom payments within 24 hours. The final rule was submitted for White House review in late 2026 and isn't yet effective as I write this; check the current status before relying on it (Cybersecurity and Infrastructure Security Agency, 2024). Sector regulators (banking, energy, transport) have their own reporting rules already.

The state clocks

Every U.S. state has a breach notification law, and they differ on what counts as personal information, whether a risk-of-harm analysis is allowed, how fast you must notify (some set a fixed number of days, some say "without unreasonable delay"), and whether the attorney general must be told. Residence of the affected person decides which law applies, not where your company is. A breach of a customer database with people in 40 states is a 40-law problem. This is the single best argument for having breach counsel on retainer: they maintain the matrix so you don't have to.

What "discovery" means, and why it matters

Most clocks run from discovery or from a determination, and both words get argued over. The practical rule: the clock starts when a reasonable organisation would have known, not when the right executive finally read the email. Keep a dated log of what was known, by whom, and when, from the first alert onward. It protects you when someone later asks why notification took as long as it did, and it keeps you honest with yourself about the timeline.

Where the law and good sense diverge

The FTC's practical guidance says to find out what happened and who's affected before notifying, but not to delay once you know (Federal Trade Commission, 2021). That tension is real. Notify too early and you may be wrong; too late and you're in breach of the clock. The way through is to notify in stages: tell the people who must be told on a fixed deadline what you know and what you don't, and update them as the investigation firms up. Regulators are used to that. What they don't accept is silence followed by a complete story weeks later.

What I'd do next

Make a one-page notification map for your organisation: every party, the trigger, the deadline, and who makes the call. Have counsel check it. If you'd like help building it, or walking your leadership through it before it matters, request a briefing. How to brief the board on a live incident is in The First Board Briefing After a Breach.