Lesson 5.44: Notification across jurisdictions
A group with companies in several countries can face several reporting clocks from one incident, each with its own trigger. Under GDPR it's 72 hours from awareness; NIS2 asks for an early warning within 24 hours; DORA, which applies to EU financial entities since 17 January 2025, starts its tightest clock when an incident is classified as major; the US SEC counts four business days from the materiality decision, and Turkey's KVKK sets 72 hours. In the lab you take one ransomware incident at Northwind, work out which rules apply to which entity, calculate every deadline and find the first one.
18 min
You will learn to
- Map entities to the regimes that apply to them
- Tell the triggers apart: awareness, classification, materiality
- Calculate deadlines in UTC
- Count business days with public holidays
- Build and sort a deadline table
Key terms
- GDPR Art. 33
- Notify the supervisory authority of a personal data breach within 72 hours of becoming aware.
- NIS2
- EU directive: early warning within 24 hours, notification within 72 hours, final report within a month.
- DORA
- EU Digital Operational Resilience Act for financial entities, applicable since 17 January 2025; major ICT incidents are reported in stages.
- Form 8-K Item 1.05
- SEC disclosure of a material cybersecurity incident within four business days of determining materiality.
- KVKK
- Turkey's personal data protection law; its board expects breach notification within 72 hours.
← Third-party risk · All lessons · Capstone: the annual cyber risk report to the board →