Data Breach Notification Checklist: GDPR and US States

A single incident can start several notification clocks at once, from 4 hours under DORA to 72 hours under GDPR and 60 days under HIPAA, and most of them start when you become aware, not when the investigation ends. This template gives you a breach notification procedure and checklist that covers the UK and EU GDPR, US state breach laws, the HIPAA Breach Notification Rule, the FTC Health Breach Notification Rule, SEC Form 8-K Item 1.05 and the NIS2 and DORA incident reporting regimes where they apply. It sets out the decision points, who decides, the deadlines and what each notice must contain, with a breach register that records every decision. It is written for privacy, legal, security and incident response teams. Adapt the roles, regimes and times in square brackets to your organisation and confirm them with counsel.

How to use this template

Replace text in square brackets, such as [Organisation], [DPO] and [Legal], with your own terms. "Must" is mandatory; "should" is recommended.
Delete the regimes in section 5 that do not apply to you, and add sector or country rules that do (for example payment card, telecoms or national laws outside the EU, UK and US).
The decision points (D1 to D6) in section 6 must each be recorded in the breach register in section 8 with the time, the decision and who made it.
Keep notice drafts, regulator portal links and out-of-hours contacts with this procedure. Deadlines include weekends unless a rule says otherwise.

1. Purpose

This procedure ensures that [Organisation] assesses, notifies and records personal data breaches and reportable security incidents correctly and on time, that decisions not to notify are justified and documented, and that clocks running in parallel under different regimes are tracked by one team. It runs alongside the [Incident Response Plan], whose containment and investigation work continues in parallel.

2. Scope

All suspected or confirmed incidents affecting personal data held or processed by or for [Organisation], in any format, including data held by processors and suppliers.
Security incidents that may be reportable under NIS2, DORA or securities rules even when no personal data is involved.
Regimes in scope: [UK GDPR and Data Protection Act 2018], [EU GDPR], [US state breach notification laws for states where affected individuals reside], [HIPAA], [FTC Health Breach Notification Rule], [SEC Form 8-K Item 1.05], [NIS2 national law], [DORA], [contractual notification duties to customers and insurers].

3. Roles and responsibilities

[Breach lead / DPO]: owns this procedure, runs the risk assessment, starts and tracks clocks, and signs off regulator notifications.
[Legal counsel]: confirms which laws apply, advises on privilege, law enforcement requests and US state requirements, and approves individual notices.
[Incident response lead]: supplies facts on scope, data and containment, and flags anything that changes the assessment.
[CISO]: decides NIS2 significance and DORA classification with [Compliance], and briefs the disclosure committee.
[Disclosure committee]: (listed companies) makes the SEC materiality determination.
[Communications]: prepares individual, media and customer communications.

4. Definitions

Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (GDPR Art. 4(12)). It covers confidentiality, integrity and availability incidents, not only theft.
Awareness: the EDPB says a controller is aware when it has a "reasonable degree of certainty that a security incident has occurred" that has compromised personal data. A short initial investigation is allowed but must start promptly.
High risk: a breach likely to result in a high risk to individuals' rights and freedoms, which triggers notice to the individuals under Art. 34.
Unsecured PHI: under HIPAA, protected health information not rendered unusable, unreadable or indecipherable to unauthorised persons.
Significant incident (NIS2) / major ICT-related incident (DORA): incidents that meet the significance or classification criteria under those regimes.

5. Notification clocks at a glance

Regime	Who is notified	Clock starts	Deadline
UK GDPR / EU GDPR Art. 33	ICO or the lead supervisory authority	Awareness	Without undue delay and, where feasible, within 72 hours; reasons for any delay. Not required if unlikely to result in a risk.
GDPR Art. 34	Affected individuals	Assessment of high risk	Without undue delay
GDPR Art. 33(2)	Processor to controller	Processor's awareness	Without undue delay [contract: within 24 to 48 hours]
NIS2 Art. 23(4)	CSIRT or competent authority	Awareness of a significant incident	Early warning 24 hours; incident notification 72 hours; final report one month after the notification
DORA, Delegated Regulation (EU) 2025/301 Art. 5	Financial competent authority	Classification as major	Initial notification within 4 hours of classification and no later than 24 hours after awareness; intermediate within 72 hours of the initial; final within one month of the latest intermediate
HIPAA Breach Notification Rule	Individuals; HHS; media if more than 500 residents of a state	Discovery	Individuals and media within 60 days; HHS within 60 days if 500 or more affected, otherwise annually within 60 days of year end
FTC Health Breach Notification Rule	Individuals; FTC; media	Discovery	Within 60 calendar days; FTC at the same time if 500 or more affected
SEC Form 8-K Item 1.05	Investors (public filing)	Materiality determination	Four business days after the determination
Florida s. 501.171	Individuals; Department of Legal Affairs if 500 or more; consumer reporting agencies if more than 1,000	Determination	30 days after determination or reason to believe a breach occurred (15 additional days possible)
Texas	Attorney General if 250 or more Texans	Discovery	As soon as practicable and no later than 30 days
California Civil Code 1798.82	Residents; Attorney General (sample notice) if more than 500 residents	Discovery	Check the current statute text for the deadline

NCSL notes that all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have breach notification laws. They differ on what counts as personal information, timing, regulator thresholds and exemptions, and the state where the affected person lives decides which law applies. Confirm current state requirements with counsel for each incident; the three examples above are not a complete list.

6. Notification checklist

6.1 Hour 0: detect and escalate

ID	Action	Owner	Timing
N-1	Any suspected incident involving personal data is reported to [Breach lead] through [channel], including by processors and staff.	All staff, [IR lead]	Immediately
N-2	Open a breach register entry and record the time of the first report.	[Breach lead]	Within [1 hour]
N-3	Notify [Legal], [CISO] and, where in scope, [Compliance] for DORA and [Disclosure committee] for SEC.	[Breach lead]	Within [2 hours]
N-4	Check the cyber insurance policy notification clause and the insurer's breach hotline.	[Risk / Legal]	Within [24 hours]

6.2 Decision points

Decision	Question	If yes	If no
D1	Is there a reasonable degree of certainty that personal data was compromised?	Awareness reached: record the time; GDPR 72-hour clock runs.	Keep investigating promptly; record why certainty is not yet reached.
D2	Is the breach likely to result in a risk to individuals?	Notify the supervisory authority (N-10).	Record the reasoning in the register; no regulator notice.
D3	Is the risk high?	Notify individuals (N-14) unless an Art. 34(3) exemption applies.	Record the reasoning.
D4	Are US residents affected, and is their data "personal information" under their state's law, not covered by an exemption such as encryption?	Apply each state's notice, regulator and credit bureau rules (N-17).	Record the analysis per state.
D5	Is [Organisation] subject to HIPAA, the FTC rule, NIS2 or DORA, and is the incident within their definitions?	Run the sector clocks in section 5 in parallel.	Record why not.
D6	(Listed companies) Is the incident material?	File Form 8-K Item 1.05 within four business days.	Record the analysis; reassess as facts change.

6.3 Risk assessment

Assess the likely consequences for individuals, not for [Organisation]. Record each factor:

Data type: special category data, financial data, government ID numbers, credentials, children's data and location data raise severity.
Volume and people: number of individuals and records, and whether vulnerable people are affected.
Identifiability: how easily the data identifies individuals, alone or combined with other data.
Intelligibility: whether the data was encrypted with a key that was not compromised. The EDPB gives the example of "the loss of a securely encrypted mobile device" where the key stays secure, which may not need notifying; reassess if the key is later compromised.
Recipient and intent: a trusted recipient who confirms deletion versus a criminal actor or public exposure.
Consequences: identity theft, fraud, financial loss, discrimination, reputational damage, physical harm or loss of confidentiality.
HIPAA four factors: nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and the extent of mitigation. Under HIPAA an impermissible use or disclosure is presumed to be a breach unless the assessment shows a low probability of compromise.

Where credentials, API keys or session tokens are in the breached data, rotate them before notifying, so the notice can tell people what has already been done. See the Leaked Credential Response Playbook.

6.4 Supervisory authority notification (GDPR)

ID	Action	Owner	Timing
N-10	Identify the authority: the ICO for UK GDPR; the lead supervisory authority for cross-border EU processing. A controller outside the EEA with only an EU representative must notify every authority where affected people live (EDPB Guidelines 9/2022, para. 73).	[DPO]	Within [24 hours] of awareness
N-11	Include the Art. 33(3) content: the nature of the breach, with categories and approximate numbers of individuals and records; DPO or contact details; likely consequences; measures taken or proposed, including mitigation.	[DPO]	Within 72 hours of awareness
N-12	If facts are incomplete, submit an initial notification and supply the rest in phases "without undue further delay". If later than 72 hours, include the reasons for the delay.	[DPO]	As facts emerge
N-13	Record the reference number and every follow-up in the register.	[DPO]	Each submission

The ICO warns that failing to notify a breach when required can lead to a fine of up to £8.7 million. See the GDPR Compliance Guide for Security Teams.

6.5 Notifying individuals

ID	Action	Owner	Timing
N-14	GDPR high risk: tell individuals without undue delay, "in clear and plain language", with the nature of the breach, contact point, likely consequences and measures taken, plus specific steps they can take (for example password reset, fraud alerts).	[DPO] / [Communications]	Without undue delay
N-15	Check the Art. 34(3) exemptions and record which applies: (a) data unintelligible, such as by encryption; (b) later measures mean high risk is no longer likely; (c) disproportionate effort, in which case use a public communication instead.	[DPO] / [Legal]	Before deciding not to notify
N-16	Prepare the call centre script, FAQ page and any identity protection offer before notices are sent.	[Communications]	Before dispatch
N-17	US: build a residency list, apply each state's content, method, regulator and consumer reporting agency rules, and send notices within the shortest applicable deadline. Submit regulator copies, for example the sample notice to the California Attorney General where more than 500 California residents are notified.	[Legal]	Shortest state deadline

6.6 Sector and securities regimes

HIPAA covered entities and business associates: notify individuals within 60 days of discovery, HHS (without unreasonable delay and within 60 days for 500 or more; an annual log for fewer) and prominent media where more than 500 residents of a state or jurisdiction are affected. Business associates notify the covered entity within 60 days of discovery. The entity carries the burden of proving notices were given or no breach occurred. See the HIPAA Security Rule Guide and the Change Healthcare breach, the largest US healthcare data breach, for notification at scale.
Health apps outside HIPAA: vendors of personal health records and related entities fall under the FTC Health Breach Notification Rule, which includes unauthorised disclosure, not only hacking.
SEC registrants: make the materiality determination without unreasonable delay after discovery, then file Item 1.05 within four business days, describing the material aspects of the incident's nature, scope and timing and its material impact. A delay is possible only if the US Attorney General determines that disclosure poses a substantial risk to national security or public safety. Foreign private issuers use Form 6-K.
NIS2 entities: the early warning must say whether the incident is suspected to be malicious or may have cross-border impact; recipients of services may also need to be told. See the NIS2 Directive Guide.
DORA financial entities: the weekend and bank holiday extension to noon on the next working day does not apply to initial and intermediate reports from credit institutions, central counterparties, trading venues and NIS2 essential or important entities. See the DORA Guide.

7. Processors, suppliers and customers

Contracts with processors and suppliers must require notice to [Organisation] within [24 to 48 hours] of awareness, with the facts needed for Art. 33(3), so that the controller's 72 hours are not used up waiting. Statutory backstops are looser: GDPR says "without undue delay", Florida gives third-party agents 10 days and HIPAA gives business associates up to 60 days.
When [Organisation] is the processor, it must notify each affected controller without undue delay and must not notify regulators or individuals on the controller's behalf unless the contract says so.
Check customer contracts for their own notification clauses, which are often shorter than the legal deadlines.

8. Breach register and records

Art. 33(5) requires the controller to document every personal data breach, its facts, effects and remedial action, so the authority can verify compliance. The ICO tells organisations to record all breaches, whether or not they are reported. HIPAA places the burden of proof on the entity. The register must hold:

Field	Content
Timeline	First report, awareness time (D1) and each notification sent, with timestamps.
Facts	What happened, systems, data categories, number of individuals and records, jurisdictions.
Decisions	D1 to D6 with reasons, the risk assessment and who decided.
Notifications	Recipients, references, copies of notices, follow-ups and reasons for any delay.
Remediation	Containment, credential rotation, control changes and owner sign-off.

9. After notification

Track and meet follow-up obligations: phased GDPR updates, the NIS2 final report and DORA intermediate and final reports, and SEC amendments to the 8-K as material information becomes available.
Answer regulator questions through [DPO] only, with [Legal] review.
Hold a lessons-learned review within [30 days] and report to [governance forum] on: time from detection to awareness; time from awareness to regulator notice; notifications made within deadline (target [100]%); breaches recorded but not notified, with reasons; and recurring root causes.

10. Source references

Implementation guidance

Map your regimes first: list every law, sector rule and contract that could require notice, with the regulator, portal, threshold and deadline, and keep the section 5 table current. The Global Privacy Regulatory Map and Global Cybersecurity Regulatory Map help with the first pass.
Know where data and people are: notification depends on which data was affected and where the people live. A current record of processing makes D2 to D4 hours of work instead of days. See the Data Mapping and ROPA Guide.
Pre-draft everything: regulator form answers, individual notices, the SEC disclosure outline and holding statements, approved by [Legal] in advance.
Exercise the clocks: run a tabletop at least yearly that starts on a Friday evening, involves a processor and residents of several US states, and times D1 to D6 against the deadlines.
Preserve evidence: keep logs and forensic images that show what data was accessed. Without them, the risk assessment defaults to the worst case. See the Digital Forensics (DFIR) Guide.

Small organisations subject only to UK or EU GDPR can run this with the DPO and one lawyer. Groups with US customers, health data or a listing need a standing breach team with external counsel on retainer, because state, HIPAA and SEC tracks run in parallel with different decision makers. This guide summarises breach notification requirements under the GDPR, selected US state laws and US and EU sector rules as at October 2026 and is not legal advice.

This template is provided for guidance and must be adapted to your organisation. It is not legal advice. Related NHI Mgmt Group resources: Incident Response Guide · GDPR Compliance Guide for Security Teams · Privacy Programme Guide for Security Teams · Cyber Insurance Guide

Data Breach Notification Checklist (GDPR and US States)