DataTerminology.comNEW
A legal obligation to inform regulators and affected parties about qualifying data breaches within prescribed timelines.
DESCRIPTION
Breach notification is the requirement to report certain security incidents that compromise personal or sensitive data to authorities and impacted individuals within specific time limits. The scope, thresholds, and timelines vary by jurisdiction and sector—GDPR mandates notification to authorities within 72 hours, while HIPAA prescribes additional disclosures. Effective processes involve incident classification, legal assessment, evidence preservation, stakeholder communication, and post-incident remediation. Strong governance, predefined runbooks, and cross-functional coordination help organizations comply and maintain trust.
ALTERNATIVE DEFINITIONS
European Union (GDPR, Article 33)
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority…
Specifies a 72-hour timeline for notifying the supervisory authority and places the duty on the controller.
U.S. Department of Health & Human Services (HIPAA)
A covered entity must provide notification of a breach of unsecured protected health information to affected individuals, the Secretary, and, in certain circumstances, to the media.
Defines who must be notified under HIPAA and includes the media for large breaches.
Wikipedia
Security breach notification laws or data breach notification laws require a business or a government entity to notify customers and other parties when their personal information has been breached.
Provides a general, cross-jurisdictional description of the legal requirement.
RELATED TERMS
Data Breach Incident Response GDPR HIPAA CCPA Data Privacy Officer Data Protection Impact Assessment Security Incident Governance Security
COMPETING TERMS
Coordinated Vulnerability Disclosure
KNOWLEDGE AREAS
Data Privacy & Compliance Data Security Data Governance Data Management AI Governance
TARGET AUDIENCE
Data Privacy Officer Chief Information Security Officer IT Manager Data Governance Manager IT Auditor Security Architect Cybersecurity Engineer Chief Information Officer Chief Technology Officer
EXTERNAL SOURCES
- Wikipedia - Security breach notification laws
- European Data Protection Board - Guidelines on personal data breach notification
- UK Information Commissioner’s Office - Practical guidance on breach reporting
- U.S. Department of Health & Human Services - HIPAA breach notification requirements
- Cybersecurity and Infrastructure Security Agency - Portal and guidance for incident reporting
TOP QUESTIONS
What triggers Breach Notification under GDPR?
Notification is required when a personal data breach is likely to result in a risk to individuals’ rights and freedoms. Controllers must notify the authority within 72 hours of awareness.
Category: Requirements
Who must be informed in a Breach Notification?
Typically the relevant regulator and affected individuals must be informed; sectoral laws may also require notifying partners or media above certain thresholds.
Category: Requirements
Why is Breach Notification important?
It ensures transparency, enables individuals to take protective actions, and helps regulators oversee systemic risks. It also drives organizations to strengthen security practices.
Category: Relevancy
What is a common mistake with Breach Notification?
Delaying assessment and evidence collection often leads to missed deadlines or incomplete reports. Establishing clear playbooks and roles mitigates this risk.
Category: Mistakes
How fast must Breach Notification happen?
GDPR requires notification to the authority within 72 hours, while HIPAA and other regimes have their own timelines. Always check your applicable jurisdiction.
Category: Requirements
What is the risk of mishandling Breach Notification?
Noncompliance can result in fines, lawsuits, and reputational damage. Inadequate communication can erode customer trust and prolong recovery.
Category: Risk
How is Breach Notification coordinated in practice?
Legal, security, privacy, and communications teams coordinate triage, risk assessment, drafting notices, and regulator engagement using predefined runbooks.
Category: Management
What data should a Breach Notification include?
It typically includes incident description, data categories affected, likely consequences, mitigation steps, and contact details for further information.
Category: Requirements
What term is closely related or alternative to Breach Notification?
Coordinated Vulnerability Disclosure relates to notifying about vulnerabilities rather than breaches but illustrates timely, responsible disclosure practices.
Category: Alternatives