What Are My Data-Protection and Breach-Notification Obligations?

When a breach happens, the notification decision is often the most consequential and time-critical judgement a firm makes, and the clock starts at discovery, not at convenience. Penalties for getting it wrong can exceed those for the breach.

This report sets out the notification framework in your chosen jurisdiction and industry: how the obligations stack, from GDPR's 72 hours and NIS2's 24-hour initial notice to state and sector deadlines, and why the duty turns on data type and affected individuals.

It documents the pattern regulators have set, penalising late, incomplete or misleading notification as heavily as the breach itself, while a single incident can require dozens of distinct notifications on different timelines.

It covers the preparation that holds under pressure, a current data map, pre-drafted templates and rehearsed ownership, and when to engage breach counsel and forensic specialists to establish scope.