Cyber Incident Breach Notification Deadline Calculator

Excludes federal holidays and weekends. A limited delay of up to 30 days is available only if the U.S. Attorney General determines disclosure poses a substantial risk to national security or public safety.

Covers significant cyber incidents affecting critical infrastructure. Supplemental reports are required if substantial new information becomes available.

Applies even if the underlying attack had not previously been classified as a covered incident.

Where notification is not made within 72 hours, it must be accompanied by reasons for the delay. Notification to data subjects (Art. 34) is required without undue delay if high risk to rights and freedoms.

Breaches affecting 500 or more residents of a state or jurisdiction require prominent media notices and immediate notification to the Secretary without unreasonable delay and in no case later than 60 days.

Notice is required if the event has a reasonable likelihood of materially harming any material part of normal operations, or if notice is provided to any other regulator.

Electronic reporting portal must be utilized. Notice to affected individuals required without unreasonable delay and in no case later than 60 consecutive days.

Requires immediate forensic engagement with a qualified Payment Card Industry Forensic Investigator (PFI).