Data breach response starts with a short, accurate public statement that says what happened, what data is involved, what the company is doing and what affected people should do next. Deadlines run from discovery or from the materiality decision: GDPR gives 72 hours to notify the regulator where feasible, and the SEC gives public companies four business days after deciding an incident is material.
Last updated: October 31, 2026
Summary: This guide covers the legal clocks that start after a breach, the five parts of a first public statement, what Uber's 2016 breach shows about concealment, who should hear the news first, and a 72-hour timeline labeled as working guidance. It is a communications guide, not legal advice.
Contents
- Which deadlines apply in the first 72 hours
- What the first public statement should say
- What happens when a company hides a breach
- Who should hear first
- What a 72-hour timeline looks like
- How to measure the response
- Frequently asked questions
Which deadlines apply to a data breach in the first 72 hours?
The deadlines depend on where the company operates and whether it is public, and two of the best known are the GDPR's 72-hour notice and the SEC's four-business-day filing. A company should map every rule that applies before it writes a public word.
| Rule | Who it covers | Clock |
|---|---|---|
| GDPR Article 33 | Controllers of personal data of people in the EU | Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals |
| GDPR Article 34 | Controllers, when the breach is likely to be a high risk to individuals | Tell the affected individuals without undue delay |
| SEC Form 8-K Item 1.05 | Public companies, with later dates for smaller reporting companies | File within four business days after determining the incident is material |
Article 33's text, hosted by GDPR Article 33 text, says a notification after 72 hours must explain the delay. The SEC's rules took effect on December 18, 2023, with smaller reporting companies required to comply from June 15, 2024, according to a National Law Review summary of the SEC rules. The company must decide materiality without unreasonable delay after discovery, and the Department of Justice can grant a 30-day delay in narrow national security or public safety cases, according to the same summary.
Other laws apply by state, country and industry. Counsel should list every one before the first statement goes out. The SEC clock guide covers what communications does inside the four-day window.
What should the first public statement say?
The first public statement should say five things: what happened, what data is involved, what the company is doing, what affected people should do and when the next update will come. Anything the company cannot confirm should be labeled as not yet known.
- What happened, in plain words, with the date the company discovered it.
- Which kinds of data are involved, and which are confirmed not to be.
- What the company has done, such as shutting off access and hiring outside investigators.
- What affected people should do, such as changing passwords or placing a fraud alert.
- Where to get help, and when the next update will be published.
Here is a fictional example that shows structure only and must be reviewed by counsel: "On November 3, Example Corp found that an unauthorized party accessed a customer database. Names and email addresses were affected. Payment card numbers were not stored there. We have shut off the access and engaged outside investigators. Customers should change their passwords. We will publish an update by 5 p.m. Eastern on November 5."
Avoid generic lines such as a promise that the company takes security seriously. They add no fact and read as filler. The CISO first 24 hours guide explains how to build a verified fact sheet before the statement is written.
What happens when a company hides a breach?
Hiding a breach turns a security incident into a legal and reputation crisis, as Uber's 2016 breach shows. TechRepublic reported that the 2016 breach exposed data on more than 57 million Uber riders and drivers, including about 600,000 U.S. driver's license numbers.
According to the TechRepublic report on the criminal case, Uber paid the hackers $100,000 in bitcoin in December 2016 and had them sign nondisclosure agreements. TechRepublic also reported that Uber did not disclose the incident publicly or notify the Federal Trade Commission until 2017, when new chief executive Dara Khosrowshahi joined the company.
NBC News reported that Uber paid $148 million in 2018 to settle claims by all 50 states and the District of Columbia that it was too slow to disclose, in its report on the Sullivan verdict. In October 2022, a federal jury in San Francisco convicted Uber's former chief security officer, Joe Sullivan, of obstructing justice and concealing a felony, according to the same NBC News report.
The company's earlier handling is covered in the site's guide to Uber's 2016 breach. Disclosure delay was the center of the case, not the breach alone. A later example of a late-disclosure apology is in the OpenAI Australia breach apology guide.
Who should hear about a breach first?
Regulators and law enforcement usually hear first, affected individuals second and the wider public third, because the legal clocks run to regulators and individuals before they run to the press. The order below is working guidance, not a legal rule.
| Order | Audience | Why |
|---|---|---|
| 1 | Counsel, forensic team and incident lead | They set the facts and the deadlines |
| 2 | Regulators and law enforcement | Legal clocks run to them first |
| 3 | Affected individuals | They need to act to protect themselves |
| 4 | Employees and customer-facing staff | They will be asked, and must give the same facts |
| 5 | Customers, partners and investors | They need the same facts in their own channel |
| 6 | Media and the public | The public statement, posted on the company site |
Publish the full statement on the company's own site and link it from every channel. Reporters and AI assistants that answer from retrieved pages will read that page, so it should stay accurate and carry an update date. The first 24 hours crisis plan shows the same sequencing for any corporate crisis.
What does a 72-hour breach timeline look like?
A 72-hour timeline puts facts first, notices second and the public statement as soon as the facts allow. The timings below are working guidance from this guide, not figures from a published study.
| Window | Work | Output |
|---|---|---|
| Hours 0 to 4 | Name an incident lead, engage counsel and forensic investigators, stop the access | Incident log and a first fact sheet |
| Hours 4 to 24 | Confirm what data is involved, draft a holding statement and brief employees | Verified facts and an internal brief |
| Hours 24 to 48 | Draft regulator notices, prepare individual notices and a help page | Notices ready for counsel |
| Hours 48 to 72 | File required notices, publish the public statement and open a support line | Public page, filed notices and a next-update time |
Use the crisis communication plan template to assign an owner and a deadline to each row before an incident happens. If the company cannot meet a deadline, record the reason in writing, because GDPR Article 33 requires a notification made after 72 hours to explain the delay.
How do you measure a breach response?
A breach response can be measured by accuracy, speed of updates and the questions customers still have after the statement. No published benchmark exists for these measures, so compare each incident with the company's own earlier drills.
- Factual corrections needed after the first statement
- Time between promised updates and actual updates
- Support questions that the statement did not answer
- Share of coverage that repeats the company's own wording
- Regulator follow-up questions on the notice
If corrections pile up, the first statement went out before the facts were verified. The company's public claims also carry long-term risk, which the executive reputation risk plan helps track. This guide is not legal advice, and a breach response should be reviewed by counsel in every affected jurisdiction.
Frequently asked questions
How fast must a company disclose a data breach?
It depends on the law. GDPR asks for notice to the regulator within 72 hours where feasible, and the SEC requires a filing within four business days of a materiality decision.
Should a company wait for all the facts before speaking?
No. Publish what is confirmed, label what is unknown and set a time for the next update. Waiting for complete facts risks missing legal deadlines.
Should a company pay a ransom quietly?
Payment decisions belong to counsel and law enforcement, and concealment is the risk. Uber's $100,000 payment, hidden from regulators, became part of a criminal case, according to TechRepublic.
Who should speak for the company after a breach?
One named executive should speak, with a technical lead available for detail. Consistent facts from one voice reduce corrections.
What should a breach notice never include?
Unconfirmed guesses about who did it, how much data was taken or whether data was used. State only what the investigation has confirmed.