When does the GDPR's 72-hour period start?

When the controller becomes aware of the personal data breach, as Article 33 states. Weekends and holidays are not paused by this tool.

What are the NIS2 reporting deadlines?

For a significant incident, Article 23 sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification.

What is the HIPAA breach deadline?

Individual notice without unreasonable delay and no later than 60 calendar days after discovery. The date shown is the latest possible, not the target.

Free tool

Breach notification deadline calculator

Enter when you became aware of the breach: the latest dates under the GDPR, NIS2 and HIPAA appear at once. No account needed, and nothing you enter is sent.

When you became aware

Your local date and time. The deadlines appear at once.

NIS2: early warning

24 hours, Article 23

—

NIS2: incident notification

72 hours, Article 23

—

NIS2: final report

One month after the notification, Article 23

—

GDPR: notification to the authority

72 hours, Article 33

—

HIPAA: individual notice

At the latest 60 calendar days from discovery

—

How to read it

These are the deadlines written in each text, shown as the latest possible date. Whether each applies depends on the facts: a personal data breach unlikely to result in a risk need not be notified under the GDPR, and only significant incidents fall under NIS2 reporting.

National laws transposing NIS2, sector rules and your contracts may add to them. This tool gives a calculation, not legal advice: confirm with your legal or data protection contact.

Questions

When does the GDPR's 72-hour period start?: When the controller becomes aware of the personal data breach, as Article 33 states. Weekends and holidays are not paused by this tool.
What are the NIS2 reporting deadlines?: For a significant incident, Article 23 sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification.
What is the HIPAA breach deadline?: Individual notice without unreasonable delay and no later than 60 calendar days after discovery. The date shown is the latest possible, not the target.

Guides