There is no single deadline. The wait depends on which agency, which data, and which regulator: federal civilian agencies must report suspected breaches of personal data to the Cybersecurity and Infrastructure Security Agency (CISA) within one hour of detection, while other disclosure rules for health data, public companies, and banks run from 36 hours to 60 days.
The timeline a reader cares about hinges on who got breached and what kind of data was exposed. Federal agencies, healthcare providers, banks, and public companies each answer to a different clock, and some of those clocks can be paused for legitimate reasons. The sections below break down each timeline and what triggers it.
Table of Contents
- Federal Agencies Face the Shortest Clock
- Health Data Breaches Run on a 60-Day Clock
- Public Companies Must Disclose Material Incidents Within Four Business Days
- Banks Report to Regulators Within 36 Hours
- State Consumer Notification Rules Add Another Layer
- Frequently Asked Questions
Federal Agencies Face the Shortest Clock
Federal civilian executive branch agencies operate under the tightest reporting window of any sector. Once an agency's top-level security operations center identifies a confirmed or suspected breach involving personally identifiable information, it has one hour to report it to CISA, according to CISA's Federal Incident Notification Guidelines.
This standard traces back to a 2006 Office of Management and Budget memo and applies to internal reporting to the government's own cybersecurity authority, not to notifying the public. That one-hour window is about getting the incident in front of federal responders fast, so CISA can assess scope and coordinate a response across agencies. It does not by itself tell affected individuals anything — a separate step, often governed by agency-specific policy or other statutes, handles public or individual notification.
Health Data Breaches Run on a 60-Day Clock
When the breached data is protected health information, HIPAA sets the rule. A covered entity — including government health agencies — must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information, per the HIPAA Breach Notification Rule at 45 CFR §§ 164.404-164.408. The clock starts the day the breach is known or reasonably should have been known, not the day it's confirmed.
Breach size changes what else has to happen on that same timeline. For breaches affecting 500 or more individuals, the entity must also notify the Department of Health and Human Services (HHS) through its breach portal within the same 60 days, submitted alongside the individual notices, according to HHS Office for Civil Rights guidance. Smaller breaches, affecting fewer than 500 people, can instead be logged internally and reported to HHS annually, within 60 days of the end of the calendar year in which they were discovered.
Public Companies Must Disclose Material Incidents Within Four Business Days
For publicly traded companies, including those that operate critical infrastructure or hold government contracts, the Securities and Exchange Commission's cybersecurity disclosure rule sets a different kind of clock. A company must file a Form 8-K under Item 1.05 within four business days after determining that a cybersecurity incident is material, with the materiality determination itself required without unreasonable delay after discovery, per the SEC's final cybersecurity disclosure rule. The rule took effect December 18, 2023, and June 15, 2024, for smaller reporting companies.
This timeline can be paused under narrow circumstances. If the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety, the company may delay its 8-K filing by up to 30 days, with a possible additional 60-day extension, according to a Cleary Gottlieb client alert. That delay mechanism exists for national security reasons, not for a company's convenience in managing bad news.
Banks Report to Regulators Within 36 Hours
Banking organizations answer to yet another timeline. The Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corporation jointly require banks to notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a "notification incident" has occurred, as reported by Govinfosecurity.
The rule took effect April 1, 2022, with full compliance required by May 1, 2022. This 36-hour window is regulator-to-regulator notification, similar in function to the federal agency rule's one-hour report to CISA. It is designed to get banking supervisors aware of a disruptive incident quickly, separate from any later requirement to notify customers directly.
State Consumer Notification Rules Add Another Layer
Beyond federal and sector-specific rules, state law governs when consumers themselves must be told. California's SB 446, signed by Governor Gavin Newsom on October 3, 2025, and effective January 1, 2026, replaces the state's older "without unreasonable delay" standard with a fixed 30-calendar-day deadline for notifying affected California residents after a breach is discovered, according to the National Law Review.
Larger breaches carry an additional step. Under SB 446, a business whose breach affects more than 500 California residents must send a sample notice to the California Attorney General within 15 calendar days of notifying those residents, per Orrick's InfoBytes analysis. Delay is still permitted when law enforcement needs more time or when the business is still determining the breach's scope and restoring system integrity — the deadline isn't absolute the moment a breach is suspected, but it no longer bends for ordinary business judgment the way the old standard did.
Frequently Asked Questions
Does the one-hour CISA rule apply to private companies?
No. The one-hour window applies only to federal civilian executive branch agencies reporting to CISA, not to private businesses or the general public.
Can a company delay disclosing a breach indefinitely for security reasons?
No. Under the SEC rule, a national-security delay authorized by the Attorney General is capped at an initial 30 days, with one possible 60-day extension.
Does California's 30-day rule replace federal requirements?
No. SB 446 governs when California residents must be notified under state law; it operates alongside, not instead of, federal rules like HIPAA or the SEC's disclosure requirement when those also apply.
You Might Also Like
- What Rights Do Federal Employees Have After a Data Breach?
- What Is the FBI PeopleSoft Data Breach Contractor Investigation About?
- Pentagon Data Breach: What Government Employees Should Do Next