Legal duty to notify regulators and affected individuals after a security incident affecting personal data.
Breach Notification is the legal duty to notify regulators and affected individuals after a qualifying security incident. GDPR Art. 33 requires DPA notification within 72 hours; HIPAA Breach Notification Rule (§164.408) requires individual notification within 60 days and HHS notification (for breaches ≥500) ‘without unreasonable delay’.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.