# Standards and Regulatory References — Multi-Jurisdiction Breach Notification

## European Union

### GDPR Articles 33-34 — Notification Framework
- Art. 33(1): 72-hour SA notification from awareness.
- Art. 34(1): Without undue delay DS notification when high risk.
- Art. 55: Competent SA determined by establishment.
- Art. 56: Lead SA in cross-border processing (one-stop-shop).
- Art. 60: Cooperation between lead SA and concerned SAs.

### EDPB Guidelines on Lead Supervisory Authority (WP244 rev.01)
- Main establishment determines the lead SA for cross-border processing.
- Main establishment is the place of central administration in the EU, or the establishment where decisions on purposes and means are taken.
- The one-stop-shop mechanism coordinates notification across concerned SAs.

## United States — Federal Requirements

### HIPAA Breach Notification Rule (45 CFR §§164.400-414)
- 60-day individual notification for unsecured PHI.
- HHS notification: immediately for 500+, annual log for under 500.
- State AG notification per state requirements.

### Gramm-Leach-Bliley Act — FTC Safeguards Rule (16 CFR Part 314)
- Financial institutions must notify FTC within 30 days of discovering a breach affecting 500+ customers.
- Effective May 2024.

### SEC Cybersecurity Disclosure Rules (2023)
- Public companies must disclose material cybersecurity incidents on Form 8-K within 4 business days of materiality determination.

## United States — State Laws (Key Jurisdictions)

### California — Cal. Civ. Code §1798.82
- Timeline: "most expedient time possible and without unreasonable delay."
- AG notification: if 500+ California residents affected.
- Content: description of incident, types of information, remedial steps, contact information.

### New York — GBL §899-aa + SHIELD Act (§899-bb)
- Timeline: "most expedient time possible and without unreasonable delay."
- AG + Department of Financial Services + Department of State notification simultaneously.
- SHIELD Act expanded definition of private information and security requirements.

### Texas — Tex. Bus. & Com. Code §521.053
- Timeline: 60 days from determination of breach.
- AG notification: if 250+ Texas residents affected.

### Florida — Fla. Stat. §501.171
- Timeline: 30 days from determination.
- FDLE notification within 30 days if 500+ individuals affected.

### Colorado — Colo. Rev. Stat. §6-1-716
- Timeline: 30 days from determination.
- AG notification within 30 days if 500+ Colorado residents affected.

## Other International

### Canada — PIPEDA Breach of Security Safeguards Regulations (SOR/2018-64)
- OPC notification "as soon as feasible" when real risk of significant harm (RROSH).
- Individual notification "as soon as feasible" after determination.
- Records retention: 24 months from date organization determines breach occurred.

### Australia — Privacy Act 1988 Part IIIC (NDB Scheme)
- OAIC notification within 30 days (or "as soon as practicable" if assessment completed faster).
- Individual notification "as soon as practicable."
- Threshold: "eligible data breach" = serious harm likely.

### Brazil — LGPD Art. 48
- ANPD notification in "reasonable time" (ANPD Resolution CD/ANPD 15/2024 specifies 3 business days).
- Individual notification in "reasonable time."

### Japan — APPI (Amended 2022)
- PPC notification within 3-5 days (promptly) for qualifying breaches.
- Individual notification promptly.
- Mandatory for: 1,000+ subjects, sensitive data, unauthorized purpose, or criminal access.

### South Korea — PIPA Art. 34
- PIPC notification within 72 hours.
- Individual notification without delay.
- 1,000+ subjects or sensitive data triggers mandatory notification.

## Enforcement

- **Dutch DPA — Booking.com (2021)**: EUR 475,000 for 22-day late GDPR notification.
- **OAIC Australia — 13CABS (2023)**: Enforcement action for failure to notify eligible data breach within 30 days.
- **California AG — Hanna Andersson (2020)**: Settlement including penalties for delayed breach notification to California consumers.