Docs / Knowledge Base / Breach notification: regulator time limits
Breach notification: regulator time limits
Compliance
After a breach assessment, Graften shows the regulator's time limit and, where the law sets one, a date counted from the time you entered. Where a law says "promptly" or "as soon as practicable", no date is shown, because none is fixed: notify as soon as you can.
This is a summary to prompt action, not legal advice. Check the regulator's own guidance for the breach in front of you.
| Framework | Regulator | Time limit |
|---|---|---|
| Privacy Act NDB (Australia) | OAIC | Assess a suspected breach within 30 days; once it is an eligible data breach, notify the OAIC and affected individuals as soon as practicable. The date shown is when the assessment must be finished, not a date to wait for. |
| APRA CPS 234 | APRA | Within 72 hours of becoming aware of a material information security incident |
| APRA CPS 230 | APRA | Within 72 hours of a material operational risk incident |
| Privacy Act 2020 (New Zealand) | Privacy Commissioner | As soon as practicable once a breach is notifiable. The date shown is the Commissioner's 72-hour guide, not a legal deadline. |
| NZISM | NCSC | Report significant incidents promptly; no fixed hour limit |
| UK GDPR | ICO | Within 72 hours of becoming aware |
| UK NIS Regulations | Competent authority | Within 72 hours |
| MAS TRM (Singapore) | MAS | As soon as possible, and within 1 hour of discovering a relevant incident |
| PDPA (Singapore) | PDPC | Assess within 30 days; once notifiable, within 3 calendar days. The date shown counts 3 days from the time you entered, so enter when you determined it was notifiable. |
| PIPEDA (Canada) | OPC | As soon as feasible after deciding there is a real risk of significant harm |
| Law 25 (Québec) | CAI | Promptly, for an incident presenting a risk of serious injury |
| HIPAA (US) | HHS | Within 60 days of discovery if 500 or more people are affected; fewer than 500, within 60 days of the end of the calendar year |
| EU AI Act | Market surveillance authority | Immediately once a causal link is established, and within 15 days at most (2 days for widespread infringement or serious disruption of critical infrastructure; 10 days for a death) |