“You have 72 hours” is the most repeated line in breach advice, and it is a half-truth. The number comes from one law, Article 33 of the GDPR. It applies “where feasible.” It runs from when you become aware of the breach. And it is owed to a regulator, not to your customers.
The clock that actually governs your reputation is a different one. It starts when the story is public: a reporter has the file, a researcher posts a screenshot, an attacker lists your data for sale, or a customer opens a letter. Your investigation can still be running when that happens. This post separates the two kinds of clock, sets out what the main rules say in their own words, and then lays out an hour-by-hour plan for the public side: notices, press, search results and reviews.
Every rule and figure below was read from the primary source on November 14, 2026. Which rules apply to you depends on where your customers live, what data you hold and whether you are a public company, so treat this as a map for the conversation with counsel, not a substitute for it.
Two kinds of clock
Legal clocks start on a trigger defined by each rule: becoming “aware” (GDPR), discovery (HIPAA, California), or your own materiality determination (SEC). They can run in parallel, and their start dates differ.
The reputation clock starts at first public exposure and has no rulebook. Customers, journalists and search engines act on what they can find, not on what your legal team has determined. The practical goal of the first 72 hours is to make sure the first accurate account of the incident that people can find is yours.
The legal clocks, in the rules’ own words
GDPR (personal data of people in the EU)
Article 33(1): “the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority,” unless the breach “is unlikely to result in a risk to the rights and freedoms of natural persons.”
What the text adds that the shorthand drops:
- Late is allowed, with reasons: “Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.”
- Partial is allowed: “Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.”
- Even a breach you do not report must be recorded: “The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.”
“Aware” has a meaning. The European Data Protection Board says a controller is aware “when that controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.” It also says the investigation period does not give you unlimited time: “it is expected that the initial investigation should begin as soon as possible,” and “If a controller fails to act in a timely manner and it becomes apparent that a breach did occur, this could be considered as a failure to notify in accordance with Article 33 GDPR.” And over-reporting is safe: “There is no penalty for reporting an incident that ultimately transpires not to be a breach.”
Individuals are a separate duty with no hour count. Article 34(1): when a breach “is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.” The EDPB notes that “The threshold for communicating a breach to individuals is therefore higher than for notifying supervisory authorities.”
Currency check: the European Commission’s Digital Omnibus proposal would amend the GDPR. The European Parliament’s procedure page, fetched November 14, 2026, shows it at “Awaiting committee decision,” so the Article 33 text above is the current law.
Sources: GDPR Article 33, Article 34, EDPB Guidelines 9/2022, European Parliament Legislative Observatory, 2025/0360(COD).
SEC Form 8-K Item 1.05 (U.S. public companies)
The SEC’s July 26, 2023 release says: “An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material.” The SEC’s small-entity guide is explicit that the trigger is not discovery: “the deadline for filing an Item 1.05 Form 8-K is tied not to discovery but to the registrant’s determination that the incident is material,” and registrants must make that determination “without unreasonable delay.” Disclosure may be delayed if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.
On May 21, 2024, the Division of Corporation Finance said that when materiality is not yet determined, or the incident is not material, it encourages disclosure under a different item such as Item 8.01. If the impact is not yet known but the incident is material, file Item 1.05, “include a statement noting that the company has not yet determined the impact (or reasonably likely impact) of the incident, and amend the Form 8-K to disclose the impact once that information is available.” The statement carries a caveat: “This statement, like all staff statements, has no legal force or effect.”
Currency check: we read the SEC’s own pages, the latest of which was last reviewed in September 2024. A May 21, 2026 law-firm tracker reported that the SEC had asked for comment on Regulation S-K in January 2026 and that it was unknown whether the 2023 cyber rules would be revisited. We read no primary document showing a change, but confirm current status before you rely on it.
Sources: SEC press release 2023-139, SEC small entity compliance guide, SEC staff statement, May 21, 2024, Debevoise Data Blog, May 21, 2026.
HIPAA (covered entities and their business associates)
HHS says individual notices “must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach.” The 60 days is the outer limit, and “without unreasonable delay” comes first. If a breach affects 500 or more individuals, the Secretary must be notified on the same standard. Covered entities with a breach affecting “more than 500 residents of a State or jurisdiction” must also “provide notice to prominent media outlets serving the State or jurisdiction.” A business associate must tell the covered entity “without unreasonable delay and no later than 60 days from the discovery of the breach.” The HHS page we read was last reviewed July 26, 2013, so confirm against 45 CFR 164.400-414.
Source: HHS, Breach Notification Rule.
California (businesses with California residents’ data)
Since January 1, 2026, Civil Code 1798.82(a)(2)(A) says disclosure “shall be made within 30 calendar days of discovery or notification of the data breach.” Delay is permitted “to accommodate the legitimate needs of law enforcement” or “as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.” If more than 500 California residents are notified, you must “electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers.” The notice “shall be titled ‘Notice of Data Breach’” with headings “What Happened?”, “What Information Was Involved?”, “What We Are Doing,” “What You Can Do,” and “For More Information.” If you were the source of a breach that exposed a Social Security or driver’s license number, you must offer identity theft prevention and mitigation services at no cost for not less than 12 months.
Two consequences for reputation. The Attorney General’s page says residents “may Search Data Security Breaches that have been submitted to and published by our office,” so a notice to more than 500 Californians becomes a public record. And older articles saying California has no fixed day count are out of date.
Sources: California Civil Code 1798.82, California Attorney General, Data Security Breach Reporting.
Non-bank financial institutions: the FTC Safeguards Rule
Since May 13, 2024, covered financial institutions must notify the FTC “no later than 30 days after discovery” of a breach involving the information of at least 500 consumers. Source: FTC Business Blog, May 14, 2024.
Everywhere else
The FTC’s business guide notes that every state, the District of Columbia, Puerto Rico and the Virgin Islands have breach notification laws. We could not read a complete multi-state survey for this post, so we cite no other state’s deadline. Counsel needs to map each state where affected people live. Source: FTC, Data Breach Response: A Guide for Business.
The public side, hour by hour
What follows is our recommended sequence, not a legal requirement. The hours are approximate. The point is the order.
Hours 0 to 12: confirm, preserve, convene
- Assemble the team. The FTC’s guide says to bring together forensics, legal and communications, and not to destroy evidence.
- Write down when you became aware, and who knew what. This is the date the GDPR clock and the EDPB’s “reasonable degree of certainty” test will be argued from. Start one incident log and keep every decision in it.
- Stop the bleeding. The FTC advises removing improperly posted information and asking search engines and other sites to drop copies. Do this early, because it is easier before the story is indexed.
Hours 12 to 36: facts first, and no reassurance you cannot back
The most expensive mistake in this window is a premature “no sensitive data was affected.” In the SEC’s 2023 case against Blackbaud, the company announced on July 16, 2020 that the attacker “did not access donor bank account information or social security numbers.” The SEC says that within days of those statements, Blackbaud’s technology and customer relations personnel learned the attacker had in fact accessed and exfiltrated that information, but the employees “did not communicate this information to senior management responsible for its public disclosure.” Blackbaud agreed to a $3 million civil penalty, and the SEC’s charges were about misleading disclosures, not about the attack itself. A reassurance that later breaks becomes the headline.
So in this window:
- Decide, with counsel, which clocks apply and which notices are triggered now. Phased filing is permitted under GDPR, and the SEC staff’s guidance allows an Item 1.05 filing that says impact is not yet determined.
- Draft the individual notice using the required headings and content: California’s five headings above, GDPR 33(3)‘s nature of the breach, categories and approximate numbers, contact point, likely consequences and measures taken.
- Hold your public statement to what the notice says. Nothing in the press release should be broader or more reassuring than what you are telling regulators.
Hours 36 to 72: notices, owned page, press, search, reviews
Notify people directly. A press release does not count. The EDPB: “A notification solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual,” and “Dedicated messages should be used when communicating a breach to data subjects and they should not be sent with other information, such as regular updates, newsletters, or standard messages.” HHS specifies first-class mail, or email if the person agreed to electronic notice.
Publish an owned page. The FTC’s guide tells breached businesses to anticipate questions and put plain-language answers on their website, and to tell people how you will contact them in future. The second point doubles as phishing defense: once a breach is public, scammers imitate it, so tell people which channels you will never use. California’s notice headings are a ready skeleton for the page.
Brief the press from the same text. If HIPAA’s media rule applies, you have to do it anyway. Where you notify more than 500 California residents, a journalist can find your notice on the Attorney General’s public list, so assume the notice itself is the first draft of the story.
Plan for search. News coverage of the breach will rank, and you usually cannot remove it. Google’s help page says it will not remove “web pages that are owned by: Educational or government institutions; Newspapers,” and that “if the content is about something important or newsworthy, like the news, Google might not take it down.” Your lever is a clear, dated, accurate page of your own that answers what people search for. Individuals whose data leaked have their own tools; our guide to what to do when your license, email and address leak is worth linking from your notice page.
Plan for reviews. Expect a wave, from affected customers and from people reacting to the news. Yelp describes its response to such surges: “When we notice an unusual spike in activity on a business page, we will display an Unusual Activity Alert and temporarily disable the posting of content.” Google is blunt about flagging: “Do not report a review just because you disagree with it or dislike it.” Reply to each real review with the same facts as your notice. Never buy, script or suppress reviews: the FTC’s Consumer Reviews and Testimonials Rule has been in effect since October 21, 2024, and its civil penalty ceiling is $53,088 per violation. The full playbook, including measurement, is in After the Breach Notice, the Reviews.
Sources: EDPB Guidelines 9/2022, SEC press release 2023-48, Blackbaud, Google Search Help, Results about you, Google Search Help, Remove my private info, Yelp Trust and Safety, Google Business Profile Help, 16 CFR 1.98.
Mistakes that make hour 72 worse
- Treating a press release as notice. See the EDPB sentence above.
- Reassuring before you know. The Blackbaud statement is the cautionary example.
- Reading the clocks from the wrong date. GDPR counts from awareness, the SEC from materiality determination, HIPAA and California from discovery. Do not use that as a reason to delay the investigation, as the EDPB’s warning on timely action makes clear.
- Going silent after the notice. People who receive a letter go looking for the company’s side. If your owned page is empty, someone else’s account fills the gap.
- Acting on reviews in a way that creates a second incident. Fake, incentivized or suppressed reviews turn a security story into a trust story.
- Blaming a vendor in public. If a supplier’s breach is the cause, your own responsibility to notify usually remains. That is a topic of its own: Your Vendor Was Breached and Your Customers Blame You.
Where a reputation team fits
The legal work belongs to counsel. The reputation work, meaning the owned page, press handling, search monitoring and review replies, can run in parallel from hour zero, and is faster when the groundwork exists before the incident. That is the shape of our Crisis PR, Reputation Monitoring and Review Management engagements. For a broader executive-level view, see the executive reputation crisis playbook.
To see how exposed your reputation is before an incident, the 90-second audit runs in your browser. The strategy call is free. This article is general information, not legal advice.