Ibravra is the decision engine and digital knowledge hub for modern founders, operators, and cross-border businesses. We publish research-backed incorporation guides, interactive financial tools, and head-to-head software reviews.

Are Ibravra business tools and calculators free to use?

Yes, all interactive financial calculators, invoice generators, and business launch checklists are 100% free with no registration or credit card required.

How does Ibravra verify software reviews and guides?

All IBRAVRA content follows our strict Editorial Constitution and Post-AI Value Rule, requiring real practitioner experience, primary source statutory checks (IRS/FinCEN), and verifiable benchmarks.

How long do I really have under the GDPR?

Seventy-two hours from awareness under Article 33, in calendar hours, with reasons required for delay. The Article 34 notice has no fixed hours: it is due without undue delay where high risk is likely. A phased filing inside 72 hours complies; a filing on day five does not.

Does California give me 30 days?

The statute sets no fixed number of days. A 2025 amendment imposing a 30-day deadline has been reported but was not verified against the statute text, so this guide does not state it as law.

When does the SEC four-business-day clock start?

At the materiality determination, not at discovery. A company that determines materiality on a Friday files by the following Thursday.

Do I have to pay a ransom if the attacker threatens to publish my data?

No law requires payment; the US government strongly discourages it. Before any payment is discussed, screen the recipient and notify law enforcement: a payment to a sanctioned person can violate US sanctions law. Restore from tested backups first.

What does a breach cost on average?

IBM's 2025 report puts the global average at 4.44 million dollars and the US average at 10.22 million, based on 600 organisations. The mean lifecycle is 241 days; healthcare averages 7.42 million dollars and shadow AI adds 200,321 dollars.

Business Setup • 12 min read

Data Breach Response Playbook: The 72-Hour Clock, the State Notices, and the SEC Filing

One breach starts three clocks: a 72-hour regulator notice, a state notice without unreasonable delay, and a four-business-day securities filing. This playbook runs all three, with the statutes and the arithmetic on the table.

By Enow A. Jovial • Published 2026-11-11

Data Breach Response Playbook: The 72-Hour Clock, the State Notices, and the SEC Filing

A data breach is a legal operation with a technology component, and it starts three clocks: the European regulator wants notice within 72 hours, an American state wants notice in the most expedient time possible, and investors want a securities filing within four business days of a materiality decision.

This playbook is for the operator who holds customer data and runs the response: a founder, a chief operating officer, or a general counsel. It is not for a company with no personal data, no EU data subjects, and no US customers, and it is not a substitute for counsel.

Founder & CEO Insight — Enow A. Jovial

"A breach is the one crisis where the clock punishes honesty and delay in equal measure. Tell them too late and the fine is about the delay, not the breach. The discipline is a written record of what you knew, when you knew it, and why you decided."

— Enow A. Jovial, Founder & Chief Executive Officer

What counts as a breach

Under the GDPR, a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A stolen laptop with an unencrypted customer list is a breach. California's test is narrower: under Civil Code section 1798.82, a breach of the security of the system means unauthorised acquisition of computerised data that compromises the security, confidentiality, or integrity of personal information. Good-faith acquisition by an employee is not a breach, provided the information is not used or disclosed further. Whether an incident is reportable often turns on what the employee did next, and logs answer that question, not memory.

The first hour has four jobs. Freeze the damage: isolate the affected system and revoke the compromised credentials. Preserve the evidence: snapshot logs and images before anyone cleans up. Start the clock record: write down when someone became aware and who reported it. Name one decision-maker until the incident closes.

Do not wipe or rebuild an affected system before forensics has captured it. Rebuilding feels like progress and destroys the only record of what the attacker touched and took. Contain first, image second, rebuild third.

The 72-hour GDPR clock

Article 33 sets the hardest deadline in breach response. The controller shall notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Late notice must be accompanied by reasons for the delay.

The trigger is awareness, not confirmation: the clock runs from the moment a responsible person knows a breach has happened. The clock runs in calendar hours, and the weekend does not pause it. The exception is narrow: skip the notice only where the breach is unlikely to result in a risk, and defend that call with a written risk assessment. The notification must carry: the nature of the breach and the numbers of people and records; the data protection officer's contact details; the likely consequences; and the measures taken or proposed. Missing information may follow in phases without undue further delay, provided the first filing lands inside 72 hours.

\text{Regulator deadline} = \text{Awareness time} + 72 \text{ hours}

Your security lead confirms at 09:00 on Tuesday, 3 November 2026 that an attacker copied a customer database; the Article 33 notice is due by 09:00 on Friday, 6 November 2026. A processor must notify the controller without undue delay; the controller's 72 hours run from its own awareness.

Article 33 of the GDPR, showing the 72-hour notification rule

When the people affected must be told

Article 34 raises the bar and changes the audience. When the breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall tell the data subject without undue delay, in clear and plain language, describing the breach, the contact point, the likely consequences, and the measures taken.

The distinction is one word: high. Article 33 fires on risk. Article 34 fires on high risk. A breach of encrypted data where the key was not compromised will often clear Article 33 but not reach Article 34. Article 34(3) says so directly: no individual communication is required where protection measures rendered the data unintelligible, such as encryption. The other exits are measures that remove the high risk, and disproportionate effort, in which case a public communication must inform data subjects.

This is where most breach responses go wrong: teams either notify every individual for every breach, which trains customers to ignore the notices that matter, or they treat the regulator filing as the whole job. Assess risk, file the regulator notice, then decide the individual notice on the high-risk test, and write the reasons down.

Article 33 is the regulator clock: 72 hours from awareness, excused only where risk is unlikely. Article 34 is the people clock: high risk, without undue delay, in plain language. Encryption that held is the cleanest reason Article 34 does not fire.

The American state clock: California section 1798.82

The United States has no single federal breach-notification statute for general business. It has fifty state laws, and California's is the one most operators meet first. Section 1798.82 requires a business conducting business in California that owns or licenses computerised data with personal information to disclose a breach to the affected resident.

The California deadline is not a number: disclosure shall be made in the most expedient time possible and without unreasonable delay. The only delay the statute expressly blesses is a law-enforcement delay: notification may be delayed if an agency determines it will impede a criminal investigation, and it shall be made promptly after the agency determines it will not compromise the investigation.

California is precise where the GDPR is flexible: the notice itself is prescribed. It shall be written in plain language, titled "Notice of Data Breach," under five headings: "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information." The notice must name the business, list the data types involved, give the breach date, state whether law enforcement delayed notification, and describe the incident. Where a Social Security number or driver's license number was exposed, it must also carry the credit reporting agencies' toll-free numbers and addresses, and where a Social Security or driver's license number was exposed and the business was the source of the breach, it must offer identity-theft prevention services free for not less than 12 months.

Two thresholds change the response. Above 500 California residents, the business shall submit a sample copy, excluding personally identifiable information, to the Attorney General.

California Attorney General breach list, showing the more-than-500-resident sample-notice rule Substitute notice — email, a website posting for at least 30 days, and notification to major statewide media — is permitted only where notice would cost more than 250,000 dollars, the affected class exceeds 500,000 persons, or the business lacks sufficient contact information.

California Civil Code section 1798.82, showing the notice requirements

The SEC clock: Form 8-K Item 1.05

A public company faces a fourth clock, on a different trigger from all the others. Under Form 8-K Item 1.05, adopted in SEC Release Nos. 33-11216 and 34-97989 on 26 July 2023, a registrant must disclose any cybersecurity incident it determines to be material within four business days of that determination, describing its nature, scope, and timing, and the material impact or reasonably likely material impact.

The trigger is the materiality determination, not the discovery, which must itself be made without unreasonable delay. In May 2024 the SEC clarified that Item 1.05 covers only incidents affirmatively determined material; voluntary disclosure of an undetermined incident belongs under Item 8.01. Suppose the committee determines on Friday, 6 November 2026 that the incident is material. The four business days are Monday 9, Tuesday 10, Wednesday 11, and Thursday 12 November: the Form 8-K is due by Thursday 12 November, assuming no intervening federal holiday. The count excludes the determination day and weekends, unlike the GDPR clock.

Run the materiality meeting on a written agenda, with a named chair and minute-taker, and record the decision with reasons. The SEC's question is whether the determination was made without unreasonable delay.

The ransom decision

Ransomware turns the breach into a payment problem with a sanctions dimension most operators miss. The Treasury's Office of Foreign Assets Control issued an updated advisory on sanctions risks for facilitating ransomware payments on 21 September 2021. The US government strongly discourages paying ransom, and paying may violate US sanctions law where the recipient has a sanctions nexus. OFAC reviews license applications case by case with a presumption of denial.

Facilitators face the same risk: financial institutions, cyber insurers, and incident-response firms that move a payment to a person on the Specially Designated Nationals list. OFAC weighs mitigation: strong practices before the attack, and prompt reporting to law enforcement.

The decision is a four-part test, taken in order. First, can the business restore from tested backups without paying? Second, does the attacker hold data whose disclosure would cause harm restoration cannot fix — the double-extortion case, where payment buys silence, not decryption? Third, has a sanctions screening been run on the wallet address and the threat actor, with counsel? Fourth, has law enforcement been notified, so the cooperation record OFAC weighs as mitigation exists? A yes to the first ends the discussion. A no to the third ends it the other way: no payment without a screening is a sanctions gamble.

What a breach costs, in numbers you can check

IBM's Cost of a Data Breach Report 2025, researched by the Ponemon Institute across 600 organisations, puts the global average cost at 4.44 million dollars, down from 4.88 million in 2024. The US average is 10.22 million dollars, a record high. The mean lifecycle is 241 days.

\text{Decline} = \frac{4.88 - 4.44}{4.88} = 0.090 = 9.0\%

\text{US premium} = 10.22 - 4.44 = 5.78 \text{ million USD, or } \frac{10.22}{4.44} = 2.30 \times \text{ the global average}

One finding in the same report changes the planning numbers. Organisations using AI and automation extensively saved 1.9 million dollars per breach and cut the lifecycle by 80 days.

A US operator with one average breach carries 10.22 million dollars of expected cost before any fine. Run the numbers for your own headcount through the ROI calculator before the next budget cycle. A European operator with 800 million euros of turnover carries a fine ceiling of 16 million euros.

\text{Fine ceiling} = \max(10{,}000{,}000, 0.02 \times \text{Turnover in EUR})

At 50 million euros of turnover the 10 million euro flat figure is the ceiling; at 500 million the two limbs meet; above that, turnover governs. Articles 33 and 34 sit inside Articles 25 to 39, which Article 83(4) caps at 10 million euros or 2 percent of worldwide annual turnover.

The notification sequence, in order

A breach that touches Europe, California, and a public listing has one sequence:

Step	Action	Deadline	Authority
1	Contain, preserve evidence, open the record	Hour 0	GDPR Art. 33(5)
2	Processor notifies controller	Without undue delay	GDPR Art. 33(2)
3	Notify the supervisory authority	72 hours from awareness	GDPR Art. 33(1)
4	Decide the high-risk test	Without undue delay	GDPR Art. 34(1) and 34(3)
5	Notify affected California residents	Most expedient time possible	Cal. Civ. Code § 1798.82(a)
6	File sample notice with Attorney General	More than 500 California residents	Cal. Civ. Code § 1798.82(f)
7	Determine materiality	Without unreasonable delay	SEC Release 33-11216
8	File Form 8-K Item 1.05	Four business days after determination	Form 8-K Item 1.05
9	Decide the ransom question	Before any payment	OFAC Updated Advisory, 21 Sep 2021

Execution checklist

Isolate affected systems, revoke credentials, image them before rebuild.
Record the awareness time and the reporter; name one decision-maker.
Confirm whether personal data was acquired and whether encryption held.
File the Article 33 notice inside 72 hours, in phases if needed.
Run the Article 34 high-risk test and write the decision down.
Draft the California notice under the five statutory headings.
Count affected California residents; above 500, prepare the Attorney General sample copy.
Convene the materiality meeting, record the decision, file the Form 8-K within four business days if material.
Run sanctions screening on any ransom demand before payment, and notify law enforcement.
Offer 12-month identity-theft mitigation services where California requires them.

Operational checklist

[x] Article 33 notice filed inside 72 hours or delay reasons recorded
[x] Article 34 high-risk decision written down
[x] California notice drafted under the five headings
[x] Attorney General sample copy filed where more than 500 are affected
[x] Materiality decision minuted, Form 8-K filed inside four business days
[x] Ransom demand screened against sanctions lists before payment

Related reading on Ibravra: GDPR DSAR Response: The 30-Day Playbook runs the access-request clock that follows a breach inquiry; CCPA and CPRA Consumer Deletion Request Playbook covers the deletion duty that customers raise after a breach notice; PCI DSS SaaS Scope and SAQ Assessment Playbook covers cardholder-data scope when payment data is in the breach; General Liability vs Professional Liability vs Cyber Insurance Playbook prices the cover that funds the response; PagerDuty vs Opsgenie vs incident.io Incident Management Pricing Playbook compares the paging tools that carry the first-hour callout.