Cybersecurity Glossary
Breach Notification
The legal duty to tell regulators and affected people when personal data has been exposed.
What Breach Notification means
Most regimes set a clock that starts when you become aware of a breach, not when you finish investigating. In the European Union that is seventy two hours to the supervisory authority. United States rules vary by state and by sector, and several require notice to individuals without unreasonable delay. The content of the notice is prescribed too.
Why Breach Notification matters for small businesses and nonprofits
The clock is the part small organisations miss. Deciding who writes the notice, who signs it and where the regulator contact form lives is a thirty minute job before an incident and a very bad afternoon during one.
What to do about Breach Notification
- Write down which rules apply to you, the deadline in each and the exact contact route
- Name the person who decides that a notification is required, and a deputy
- Keep a draft notice ready, so the incident only has to fill in the specifics
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.
The legal duty to tell regulators and affected people when personal data has been exposed.