Breach notification rules do not all start the clock at the same moment. GDPR runs from awareness, HIPAA and the FTC Safeguards Rule from discovery, New York's Part 500 from the entity's determination that an incident occurred, and the SEC's Item 1.05 from a materiality determination. Knowing which applies shapes your triage design. This is education, not legal advice.
The five triggers
GDPR Article 33: awareness. The controller notifies the authority within 72 hours, where feasible, after having become aware of the breach. The processor tells the controller without undue delay once aware.
HIPAA: discovery. Section 164.404 treats a breach as discovered on the first day it is known, or would have been known with reasonable diligence. Knowledge of a workforce member or agent counts, except the person who committed the breach. The outer limit is 60 calendar days.
FTC Safeguards Rule: discovery. Under 16 CFR 314.4(j), an event is discovered on the first day it is known to the institution, with knowledge of any employee, officer or agent counting, except the person who committed the breach. The limit is 30 days, as soon as possible, for events involving at least 500 consumers.
NYDFS 500.17: determination. The 72 hour notice runs from determining that a cybersecurity incident occurred.
SEC Form 8-K Item 1.05: materiality determination. According to the SEC fact sheet, registrants must determine materiality without unreasonable delay after discovery, and file generally within four business days of determining the incident is material.
What the differences mean
"Determination" rules give you room to investigate, but not to stall. The SEC says without unreasonable delay. A review that drags without a reason can be questioned.
"Knowledge" rules, with imputation, mean the first person who sees the signs matters. If an analyst notices exfiltration on Monday, the entity can be treated as knowing on Monday.
"Reasonable diligence" in HIPAA means an alert nobody looked at may still count.
Designing triage for all of them
You rarely need five processes. Build one that satisfies the strictest.
- Timestamp the first credible signal. Record when someone first saw it and who.
- Time box the assessment. Set an internal deadline for deciding whether personal data or a material event is involved.
- Escalate on suspicion, not certainty. Give analysts a way to page the incident lead and privacy lead.
- Keep a single timeline. Add notes as facts arrive. Counsel will map them onto each regime.
- Test it. Run an exercise where the "discovery" moment is ambiguous and see whether people agree on it.
Limits of this comparison
Several rules have exceptions, such as law enforcement delays, and many other laws exist beyond these five. State breach laws, sector rules and contracts have their own triggers. Use this as a map for conversation with counsel, not a complete list.
See also: GDPR Article 33, HIPAA's 60 day clock, FTC Safeguards, NYDFS 500.17, and the SEC 8-K rule.
Quick check
Which trigger is strictest?
Awareness and discovery rules with imputed knowledge tend to start earliest. A design that logs the first credible signal serves all of them.
Can we wait until the investigation finishes?
Generally not. GDPR allows phased notice, and the FTC says to file what you know and update later.
Sources
- GDPR Article 33
- 45 CFR 164.404
- 16 CFR 314.4
- 23 NYCRR 500.17
- SEC fact sheet on cybersecurity disclosure rules
Last reviewed: 19 October 2026.
