A zero-day on its own is a vulnerability, not a breach, so it does not by itself trigger notification. Duties start when an incident occurs: personal data is breached under GDPR, a significant incident hits an entity covered by NIS2, or a public company determines a cybersecurity incident is material. This is general information, not legal advice.
Vulnerability versus incident
If you are exposed but no one has exploited you, there is usually nothing to notify. If someone has exploited the flaw and accessed or damaged systems or data, you may have an incident. That is why the compromise check matters: it tells you which side of the line you are on. See how to check for exploitation before the patch.
Three regimes compared
| Regime | Who | Trigger | Clock |
|---|---|---|---|
| GDPR Article 33 | Controllers of personal data | Personal data breach likely to risk individuals' rights and freedoms | Without undue delay and where feasible within 72 hours of becoming aware |
| NIS2 Article 23 | Essential and important entities | Significant incident | Early warning within 24 hours, notification within 72 hours, final report within one month of the notification |
| SEC Form 8-K Item 1.05 | Public registrants | Cybersecurity incident determined to be material | Four business days after the materiality determination |
Each regime has its own definitions. "Becoming aware" and "significant" are legal terms, so ask counsel how they apply to your facts.
GDPR details worth knowing
The controller carries the notification duty, and a processor must alert the controller without undue delay. If you miss 72 hours, the notice must state reasons for the delay. Information can be provided in phases. Controllers must also document every breach, with facts, effects and remedial action.
If the breach is unlikely to pose a risk to individuals, no notice to the authority is required, though you must still document it.
NIS2 stages
The early warning should say whether unlawful acts are suspected and whether the incident could have cross-border impact. The 72 hour notification updates it with an initial assessment and indicators of compromise where available. The final report adds root cause and mitigations.
Prepare the facts
Keep an up to date record of where personal data lives and which systems process it. In a zero-day event that record lets you answer "what data sat on the affected hosts" in minutes.
What to do while you decide
Keep a dated record of when you learned of the flaw, when you learned of any exploitation, and what data sat on affected systems. Involve counsel early, because the awareness date is often the key fact. If unsure, prepare a draft notice while you finish the facts.
Quick check
Do we notify a regulator just because we were vulnerable?
Generally no. Notification duties follow an incident or breach, not exposure alone. Confirm with counsel.
When does the 72 hour clock start?
Under GDPR it runs from when the controller becomes aware of the breach. Document when and how you became aware.
Sources
Last reviewed: 19 October 2026.
