On 22 September 2026 Astrana Health determined that a cybersecurity incident was material, and its CEO signed an Item 1.05 8-K the next day, 23 September. The SEC allows four business days from a materiality determination, so the outside date would have been Monday 28 September. Astrana filed well inside it, while saying it was still assessing what data had been taken.
The useful lesson for a small company is not the filing. It is that every notification law starts its clock on a different event, and mixing them up is the most common mistake.
What's affected
Any company holding personal data of people in the EU, patients, or residents of US states. The table lists the clocks, what starts them and who gets told. It covers the ones most small software and service companies meet. It is not legal advice, and your contracts may set shorter deadlines than the law.
| Rule | Clock | Starts when | Notify |
|---|---|---|---|
| GDPR Art. 33(1) | 72 hours where feasible, with reasons if late | Controller becomes aware | Supervisory authority, unless unlikely to result in a risk |
| GDPR Art. 33(2) | Without undue delay | Processor becomes aware | The controller |
| SEC Form 8-K Item 1.05 | Four business days | Company determines the incident is material | Public filing |
| HIPAA 45 CFR 164.404 | Without unreasonable delay, no later than 60 calendar days | Discovery of the breach | Affected individuals |
| HIPAA 164.408 | With the individual notices if 500 or more; within 60 days after year end if fewer | Same breach | HHS |
| HIPAA 164.410 | Without unreasonable delay, no later than 60 calendar days | Business associate discovers the breach | The covered entity |
| California Civ. Code 1798.82 (SB 446) | 30 days; AG within 15 calendar days of resident notice if over 500 residents | Discovery | Residents, then AG |
| New York GBL 899-aa | Within 30 days | Breach discovered | Residents, AG, Department of State, State Police |
| Texas Bus. and Com. Code 521.053 | No later than 60 days; AG within 30 days if 250 or more residents | Determination that a breach occurred | Individuals, then AG |
| NYDFS 23 NYCRR 500.17 | 72 hours | Determining a cybersecurity incident occurred | Superintendent (covered entities) |
Two more are worth knowing. NYDFS also requires notice within 24 hours of an extortion payment, with a written explanation within 30 days. CIRCIA, the federal critical infrastructure rule with 72-hour incident and 24-hour ransom payment reporting, is not in force: a report on 5 October 2026 said CISA had sent the final rule to the White House for review and expected publication before year end.
How to check if you're exposed
For each system holding personal data, write down four things in your register:
- Which laws apply (where the people live, what kind of data, what kind of company).
- Whether you are a controller, a processor, a business associate or a covered entity.
- Which event you will treat as the starting point: awareness, discovery or determination.
- Who in your contracts must hear from you, and in how many hours.
Then check your customer agreements. Customer contracts often set their own deadlines, and some are shorter than the statutes above.
What to do now
- Keep a clock log. At the first credible sign of a breach, record the time and who knew. This date feeds every "awareness" and "discovery" test.
- Separate the legal clocks from the investigation. GDPR allows phased information, so send what you know at 72 hours and add the rest later.
- If you are a processor or vendor, tell your customers fast. Their clock may start on their own awareness, and under GDPR you must notify the controller without undue delay.
- Decide who determines materiality, if you are public, and write down the reasoning. The Astrana and Amgen filings both gave the date of determination and the grounds, such as the sensitivity of the data.
- Prepare state notice letters and an AG form in advance. California counts 30 days from discovery, and delay is allowed for law enforcement needs or to determine scope and restore system integrity.
- Ask counsel to map your top five customer countries and states, and keep the map in the incident folder.
How to avoid this trap
The trap is a single "72 hours" in people's heads. Avoid it with these steps.
- Name the start event for each clock in your plan, not just the deadline.
- Give the incident lead authority to start the clock log, so nobody waits for certainty.
- Keep a template for a first, partial notice. Astrana's filing said it was still assessing what data was affected and would amend if needed.
- Collect logs and a data map ahead of time, so you can say who is affected within days.
Why it matters
Regulators judge delay against what you knew. A late notice with no records looks worse than an early notice with gaps you flag honestly.
Clocks also rarely line up. A breach that you notify to a GDPR authority on day three may still be inside the 60-day HIPAA window and the 30-day California window, and a public company's four business days may start before any of them if the board determines materiality early. Plan for the shortest one, and treat the others as follow-ups.
The EU Digital Omnibus proposal would move GDPR breach reports to 96 hours through a single entry point, but as of mid-October 2026 it is a proposal, so 72 hours still applies.
Try it yourself
Pick a made-up incident: customer data in a cloud storage bucket, found Monday at 9 a.m., affecting people in Germany, Texas and California. Write the date and time each clock above would expire, then circle the first one. It is almost never the one your team expects.
Quick check
What starts the SEC Item 1.05 clock?
The company's determination that the incident is material, not the discovery of the incident. The filing is due four business days after that determination.
Under GDPR, what does a processor owe a controller?
Notice without undue delay after becoming aware of a personal data breach. The 72 hour clock to the authority belongs to the controller.
Can a notice be sent in parts?
Under GDPR Article 33(4), yes: information may be provided in phases without undue further delay. Other laws may differ, so check each one.
Sources
- Astrana Health Form 8-K, September 2026
- SEC press release 2023-139 on cybersecurity disclosure
- GDPR Article 33
- 45 CFR 164.404, individual notice
- 45 CFR 164.408, notice to the Secretary
- 45 CFR 164.410, business associate notice
- California SB 446 summary, McDonald Hopkins
- New York GBL 899-aa
- Texas Bus. and Com. Code 521.053
- 23 NYCRR 500.17
- HIPAA Journal on CIRCIA final rule review, October 2026
- Kontorbund note on the Digital Omnibus and the 96-hour proposal
