Data Breach Notification Deadline Calculator

About the Data Breach Notification Deadline Calculator

When a personal data breach or cyber incident is discovered, several clocks start at once — and the shortest is six hours. Enter the date, time and time zone at which you became aware, tick the laws that may apply, and the calculator lists every reporting deadline as an exact moment, soonest first, with a live countdown, the authority to tell and a checklist of what the report must contain.

It covers India’s CERT-In Directions (6 hours) and DPDP Rules, rule 7 (the Board without delay, and a detailed report within 72 hours), the GDPR and UK GDPR (72 hours to the supervisory authority; people without undue delay when the risk is high), the EU’s NIS2 Directive (24-hour early warning, 72-hour notification, final report a month later), the US HIPAA Breach Notification Rule (60 calendar days) and SEC Form 8-K Item 1.05 (four business days after deciding the incident is material). Times are shown in any time zone, daylight-saving changes included, and the deadlines can go into your calendar with reminders. Nothing you enter leaves your browser.

Common uses

• An incident response lead setting up the reporting timeline in the first hour of a breach.
• A DPO or privacy lawyer checking which authority is told first, and by when, across India, the EU, the UK and the US.
• Preparing a tabletop exercise or an incident response plan with realistic deadlines and report contents.
• Putting every reporting deadline into the team calendar with reminders.

The deadlines, law by law

• CERT-In (India). Service providers, intermediaries, data centres, body corporates and government organisations report the incidents listed in Annexure I of the Directions — data breaches and leaks, ransomware, unauthorised access, attacks on servers and many more — within 6 hours of noticing them or being told. CERT-In’s FAQ 30 names the incidents held to the 6 hours — data breaches and data leaks among them — and lets you send what you know first, with the rest to follow.
• DPDP Rules, rule 7 (India). A Data Fiduciary tells each affected person and the Data Protection Board without delay, then sends the Board a detailed report within 72 hours of becoming aware, or a longer period the Board allows on a written request. Rule 7 applies eighteen months after the Rules were published (rule 1(4)); the calculator shows whether it applies on the date you enter.
• GDPR and UK GDPR. The controller notifies the supervisory authority (the ICO in the UK) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people; a later notification must explain the delay. People are told without undue delay when the risk to them is high (Art. 34). A processor tells the controller without undue delay.
• NIS2 (EU). Essential and important entities send the CSIRT or competent authority an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours (24 hours for trust service providers), intermediate reports on request, and a final report within one month of the notification — as transposed by each Member State.
• HIPAA (US). Covered entities notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery; the media too when more than 500 residents of a State or jurisdiction are affected; HHS at the same time for 500 or more, or within 60 days after the end of the calendar year for fewer. A business associate tells the covered entity within 60 days.
• SEC Form 8-K Item 1.05 (US). A registrant files within four business days after determining that a cybersecurity incident is material, and must make that determination without unreasonable delay after discovery. The calculator skips weekends and federal holidays, and shows 5:30 p.m. Eastern time — EDGAR filings made after it count as filed the next business day.

How the clock is counted

Hour-based deadlines run in real elapsed hours from the moment you became aware, so a 72-hour deadline that crosses a daylight-saving change still ends 72 hours later — the wall-clock time can shift by an hour. Calendar-day deadlines (HIPAA) end at midnight at the end of the last day in your time zone. NIS2’s final report runs one calendar month from the incident notification: enter when you sent it, or the calculator counts from the latest moment it could have been sent. None of the hour-based deadlines stops for weekends or holidays.

Sources

• CERT-In Directions under section 70B(6) of the IT Act, CERT-In FAQs and the incident reporting form
• Digital Personal Data Protection Rules, 2025 — rules 1 and 7; DPDP Act, 2023 — s.8(6)
• GDPR — Arts. 33, 34; EDPB guidelines on personal data breach notification; ICO: report a personal data breach
• NIS2 Directive (EU) 2022/2555 — Art. 23
• 45 CFR Part 164, Subpart D — §§164.404–164.412
• SEC Form 8-K — General Instruction B.1 and Item 1.05; Regulation S-T Rule 13

Limitations

• An estimate, not legal advice. Whether a law applies, whether an incident is a reportable breach and who the competent authority is are legal questions — the calculator shows the deadlines if they apply.
• Sector and national rules are not covered: banking, insurance and securities regulators (for example RBI, SEBI and IRDAI in India, or DORA for EU financial entities), US state breach laws, and each Member State’s NIS2 transposition may add other or shorter deadlines.
• The deadlines are the outer limits. GDPR, DPDP and HIPAA all ask for notice without (undue) delay, and the clock does not wait for the investigation to finish.
• The SEC business-day count skips weekends and federal holidays; it cannot know a day the SEC closes unexpectedly.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.