Cyber Incident and Data Breach Reporting Deadlines (2026)

India has the shortest clocks: CERT-In, RBI and SEBI each require a cyber incident report within 6 hours. In Europe, DORA wants an initial notice 4 hours after an incident is classified as major, NIS2 an early warning within 24 hours, and GDPR a breach notification within 72 hours. From 13 May 2027, India’s DPDP Rules add a 72-hour detailed report to the Data Protection Board.

India

Rule and who it covers	Report to	Deadline	Follow-up and status
CERT-In Directions, 28 April 2022 (IT Act s.70B(6)) Service providers, intermediaries, data centres, body corporates, government bodies	CERT-In	6 hours Clock: Noticing the incident, or being told about it	Further information when CERT-In asks. Logs kept 180 days in India. In force since June 2022
RBI Cybersecurity, Technology Directions 2026, commercial banks Commercial banks	RBI, on the DAKSH platform; also notify CERT-In	6 hours Clock: Detection	In force since 31 July 2026; replaces the 2016 cyber framework
RBI Cybersecurity, Technology Directions 2026, NBFCs Non-banking financial companies	RBI, on DAKSH; also notify CERT-In	6 hours Clock: Detection	In force since 31 July 2026
RBI Master Direction on payment systems, 30 July 2024 Non-bank payment system operators	RBI; cyber incidents also to CERT-In	6 hours Clock: Detection	Annex 1 format. Phased in: large operators 2025, medium 2026, small 1 April 2028
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 20 Aug 2024 SEBI-regulated entities	SEBI and CERT-In; brokers and depository participants also to the exchange or depository	6 hours Clock: Noticing or detecting the incident, or being told about it	Details on the SEBI Incident Reporting Portal within 24 hours. In force
DPDP Rules 2025, Rule 7 (DPDP Act s.8(6)) Every Data Fiduciary	Data Protection Board and each affected person	Without delay, then a detailed report to the Board within 72 hours Clock: Becoming aware of a personal data breach	Board may allow longer for the detailed report. Applies from 13 May 2027. Failing to notify: up to ₹200 crore

A bank, NBFC or payment operator usually runs two 6-hour clocks at once: its regulator and CERT-In. From 13 May 2027, a breach of personal data adds a notice to every affected person and the 72-hour report to the Data Protection Board.

Europe, UK, US and Asia-Pacific

Rule and who it covers	Report to	Deadline	Follow-up and status
EU GDPR, Art. 33 and 34 Controllers (processors tell the controller)	Lead data protection authority; affected people if high risk	72 hours where feasible Clock: Becoming aware of the breach	Information can follow in phases; reasons needed if late. In force. Up to €10m or 2% of turnover
EU NIS2, Art. 23 Essential and important entities	National CSIRT or competent authority	Early warning 24 hours; notification 72 hours Clock: Becoming aware of a significant incident	Final report within 1 month of the notification. Applies from 18 Oct 2024, through national laws
EU DORA, Art. 19 and Delegated Regulation 2025/301 Financial entities	Competent authority	Initial notice 4 hours after classifying as major, and within 24 hours of awareness Clock: Classification as a major ICT incident	Intermediate report within 72 hours of the initial notice; final report within 1 month. Applies from 17 Jan 2025
UK GDPR, Art. 33 Controllers	Information Commissioner’s Office	72 hours where feasible Clock: Becoming aware of the breach	Information can follow in phases. In force. Up to £8.7m or 2% of turnover
UK NIS Regulations 2018, regs 11 and 12 Operators of essential services; digital service providers	Competent authority; ICO for digital service providers	72 hours Clock: Becoming aware of the incident	As the authority requires. In force. Up to £17m
US SEC Form 8-K, Item 1.05 SEC-registered companies	Public filing with the SEC	4 business days Clock: Deciding the incident is material (decision due without unreasonable delay)	Amended 8-K for information not yet known. In force since 18 Dec 2023
US HIPAA Breach Notification Rule, 45 CFR 164.400–414 Covered entities (business associates tell them within 60 days)	Affected people; HHS; media if over 500 in a state	60 days at most Clock: Discovery of the breach	Breaches under 500 people: to HHS within 60 days of year end. In force
New York DFS, 23 NYCRR 500.17 DFS-regulated entities	NY Superintendent of Financial Services	72 hours; ransom payment 24 hours Clock: Deciding an incident occurred; making a payment	Written explanation of a ransom payment within 30 days. In force
Singapore PDPA, s.26D Organisations	PDPC and affected people	3 calendar days Clock: Assessing the breach as notifiable (assessment must be expeditious)	In force since 1 Feb 2021
Australia Privacy Act, Part IIIC (Notifiable Data Breaches) APP entities	OAIC and affected people	As soon as practicable, after an assessment of up to 30 days Clock: Believing an eligible breach has occurred (assess within 30 days if only suspected)	In force
Canada PIPEDA, s.10.1 Organisations	Privacy Commissioner and affected people	As soon as feasible Clock: Deciding the breach creates a real risk of significant harm	In force
Japan APPI, Art. 26 Business operators	Personal Information Protection Commission and affected people	Preliminary report promptly (PPC guidance: about 3–5 days) Clock: Becoming aware of the breach	Final report within 30 days, or 60 days for malicious breaches. In force since April 2022

Not yet in force

Rule or proposal	What would change	Status on 10 October 2026
US CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)	72 hours for covered incidents and 24 hours for ransom payments, to CISA	Final rule under White House review since 1 Oct 2026; no effective date
UK Cyber Security and Resilience Bill	Initial notice within 24 hours and a full report within 72 hours, to the regulator and the NCSC	Before the House of Lords; not yet law
EU Digital Omnibus	GDPR breach notice moved to 96 hours, only for high-risk breaches, through one EU reporting point	Proposal under negotiation; not adopted
DPDP Rules timeline change	Bring Rule 7 and other duties forward from 13 May 2027	Proposed by MeitY in early 2026; not notified

Meeting the deadline

Every one of these clocks starts when someone in the business notices, detects or decides something, so the hours are lost before the incident reaches the person who reports it. Three things shorten that gap:

One place to log incidents, so the time of detection is on record from the start.
A named owner for each reporting duty, with the regulator, deadline and format written down before anything happens.
A link from each incident to the risks it touches, so the same event that starts the reporting clock also updates the risk register.

Riskamy does the last part on its own: tag an incident to a risk and the score moves, the owner is asked to reassess, and reminders and escalations follow. See how it works.

Frequently asked questions

What is the shortest incident reporting deadline in India?

Six hours. CERT-In requires cyber incidents to be reported within 6 hours of noticing them, and RBI and SEBI set the same 6 hours for the entities they regulate.

Does a bank report to both RBI and CERT-In?

Yes. RBI’s 2026 Directions require a report on the DAKSH platform within 6 hours of detection and a notice to CERT-In. The CERT-In Directions apply separately with their own 6-hour deadline.

When does the DPDP 72-hour breach report apply?

Rule 7 of the DPDP Rules, 2025 applies from 13 May 2027. A Data Fiduciary must then tell the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach.

How long do you have to report a breach under GDPR?

Without undue delay and, where feasible, within 72 hours of becoming aware of it. Affected people must also be told without undue delay when the breach is likely to result in a high risk to them.

Method and sources

Each row was checked against the rule’s official text on 10 October 2026, and we update this page when a rule changes. Deadlines are summarised; read the rule itself before relying on it, because scope and exceptions vary. Spotted something out of date? Email [email protected].

See it on your own register. Bring the spreadsheet you use today.

Book a demo

Incident reporting deadlines