The clocks differ in length and, more importantly, in what starts them. FTC Safeguards: 30 days after discovery. SEC Item 1.05: four business days after a materiality determination. DFARS 7012: 72 hours after discovery. GDPR Article 33: 72 hours after becoming aware. One incident can start several.
Side by side
- FTC Safeguards Rule. Covers financial institutions under the rule. No later than 30 days. Trigger: discovery of a notification event.
- SEC Form 8-K Item 1.05. Covers registrants under Exchange Act reporting. Four business days. Trigger: determination that the incident is material.
- DFARS 252.204-7012. Covers contractors and subcontractors with the clause. 72 hours. Trigger: discovery of a cyber incident.
- GDPR Article 33. Covers controllers, and processors notify controllers. 72 hours where feasible. Trigger: becoming aware of a personal data breach.
Details that change how you plan
FTC. A notification event means unauthorized acquisition of unencrypted information of at least 500 consumers. Report as soon as possible, no later than 30 days after discovery, using the FTC online form.
SEC. The four days run from the materiality decision, which must come without unreasonable delay. The filing covers nature, scope, timing and material impact, not response technicalities.
DFARS. Reports go through DIBNet and need a DoD approved medium assurance certificate. Images and monitoring data are preserved for at least 90 days after the report.
GDPR. No notice is needed if the breach is unlikely to risk individuals' rights and freedoms. If the 72 hours are missed, the notice must explain why. Information may be provided in phases. The controller must document all breaches, and a processor must notify the controller without undue delay.
Why one incident can start many clocks
A US payment company that is public, sells to EU users and supports a defense customer could be subject to several of these. Each has its own definition of the trigger, so a single internal timeline must be kept with timestamps for: first signal, discovery, awareness, scope estimate and materiality decision. Counsel decides which rule applies and when.
Build one runbook
Do not keep four plans. Keep one with a decision table.
- A single incident log with timestamps
- A named incident lead and a counsel contact
- Pre approved templates for each regulator
- Contacts for customers and prime contractors
- A vendor notice clause that makes sure your suppliers tell you quickly
The vendor problem
Your clock can start before you hear anything, depending on the rule. A supplier that tells you after two weeks has used most of a 72 hour window. Put notice periods in contracts and track them.
Test it
Run a drill with a made up incident that touches two rules and see whether the team can state each deadline in minutes. Safeguard's asset discovery and evidence automation can support the scoping and record keeping part of that work.
Quick check
Which clock is the shortest?
DFARS and GDPR are both 72 hours, but they start at discovery and awareness respectively, and the SEC clock starts later, at the materiality decision.
Sources
Last reviewed: 19 October 2026.
