Practical guide
Breach Notification Clocks Compared: GDPR, India's DPDP Rules and HIPAA
72 hours, 'without delay', 60 days: how breach notification deadlines, thresholds and recipients differ under GDPR, the DPDP Rules 2025 and HIPAA — and how SOC teams should prepare.
When a security operations centre confirms that personal data has been compromised, a legal clock usually starts. That clock is not the same everywhere. A single incident affecting customers in the EU, India and the US healthcare system can trigger three different sets of deadlines, thresholds and recipients. This guide compares them so incident playbooks can be built before they are needed.
This is general information, not legal advice. Sector rules, such as those from financial regulators, can add separate and shorter deadlines.
At a glance
| Aspect | GDPR (EU) | DPDP Rules 2025 (India) | HIPAA (US) |
|---|---|---|---|
| Trigger | Personal data breach | Personal data breach | Breach of unsecured protected health information |
| Risk threshold for regulator notice | Not required if unlikely to result in a risk to individuals | None. Every personal data breach is reportable | Breach presumed unless a risk assessment shows low probability of compromise |
| Regulator deadline | Without undue delay and, where feasible, within 72 hours of awareness | Without delay, then a detailed report within 72 hours of awareness (extendable by the Board on written request) | 500+ individuals: at the same time as individual notice. Under 500: annual log within 60 days of year-end |
| Individuals | Without undue delay if likely high risk | Without delay, every affected Data Principal | Without unreasonable delay and no later than 60 calendar days after discovery |
| Others | Processors notify controllers without undue delay | Data Processors are bound by contract | Media for more than 500 residents of a state or jurisdiction. Business associates notify covered entities |
| Applies from | Since May 2018 | Rule 7 applies 18 months after the Rules were published (expected May 2027) | Since 2009 (HITECH), as amended in 2013 |
Three things that differ more than people expect
1. Thresholds. Under GDPR, a documented assessment can conclude that a breach is unlikely to result in risk, so no regulator notice is needed (it must still be recorded internally). India’s DPDP regime has no equivalent threshold for notifying the Board and affected people. HIPAA presumes a breach, and puts the burden of the four-factor risk assessment on the organisation.
2. What “the clock” measures. GDPR’s 72 hours is for the initial notification, and information can follow in phases. The DPDP Rules require an immediate description and a detailed report within 72 hours, covering causes, mitigation and the notices sent. HIPAA’s 60 days is an outer limit, not a safe harbour: notice must still be without unreasonable delay.
3. Encryption. HIPAA treats PHI encrypted to HHS guidance as “secured”, so no notification is required. Under GDPR, strong encryption can make a breach unlikely to result in risk to individuals. Under the DPDP Rules, encryption is a required safeguard but does not by itself remove the duty to notify.
Building a multi-jurisdiction breach playbook
- Define “awareness”. Agree when the organisation is considered to have become aware, for example once a breach is reasonably confirmed, and log that timestamp.
- Pre-classify data. Maintain mappings of which systems hold EU personal data, Indian digital personal data and PHI, so the right clocks can be identified in the first hour.
- Template notices for each regime’s required content, reviewed by counsel in advance.
- Decision log. Record risk assessments, threshold decisions and who approved them.
- Contracts. Make processors and business associates notify you fast enough for you to meet your own deadlines.
- Exercise it. Run tabletop exercises with legal, privacy, communications and the SOC together.
Further reading in the Academy
See the guides to GDPR, India’s DPDP Act and HIPAA.
Sources and official references
- Regulation (EU) 2016/679 — Articles 33 and 34 — EUR-Lex (official source)
- Digital Personal Data Protection Rules, 2025 — Rule 7 — MeitY (official source)
- HIPAA Breach Notification Rule — HHS (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
