Free tool for security, legal, and compliance teams
Breach notification deadline calculator
The clocks run from different moments — HIPAA from discovery, GDPR from awareness, the SEC from the materiality determination. Enter the dates, get every deadline, each labeled with its statutory basis. Runs in your browser, no signup, nothing stored.
HIPAA: the first day the breach is known, or would have been known with reasonable diligence. GDPR: the moment of awareness.
500+ adds media notice and changes the HHS reporting path; under 500 goes to the annual log.
Everything runs in your browser; nothing is submitted or stored.
Where these deadlines come from
HIPAA deadlines are the Breach Notification Rule's outer bounds at 45 CFR 164.404 (individuals), 164.406 (media, 500+), and 164.408 (HHS). GDPR comes from Articles 33 and 34. The SEC figure is Item 1.05 of Form 8-K for registrants subject to the cybersecurity disclosure rule. The state layer is mapped in the state notification guide. Each framework's full walkthrough: HIPAA notification guide, GDPR 72-hour guide, the SEC Item 1.05 clock.
Frequently asked questions
What date do the clocks run from?
Each clock has its own trigger, and they are not the same moment. HIPAA runs from discovery — the first day the breach is known, or would have been known with reasonable diligence. GDPR runs from awareness — when you have a reasonable degree of certainty a personal data breach occurred. The SEC's Item 1.05 clock runs from the materiality determination, which is often days or weeks after discovery. The tool takes each date separately for exactly this reason.
Does HIPAA's 60-day deadline mean I can take 60 days?
No. The rule is notification without unreasonable delay, with 60 calendar days as the outer bound, not the target. Regulators read a 59-day delay on a contained, two-record breach as a violation of the reasonable-delay requirement on its own. The same logic applies to GDPR: 72 hours is the ceiling, and phased notification is expected if the full picture takes longer.
How are the SEC's business days computed?
Item 1.05 gives four business days from the materiality determination. The tool skips weekends and observed US federal holidays — New Year's, MLK Day, Presidents' Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Veterans Day, Thanksgiving, and Christmas, with the standard Saturday and Sunday observance shifts — computed rather than hard-coded, so it stays correct without a table update.
Are state deadlines computed too?
Not as one date, honestly: most US states require notification in the most expedited time possible and without unreasonable delay, several impose fixed outer bounds of 30, 45, or 60 days, and some tie timing to when the breach was contained. One number would be an invented number. The tool links the state-by-state guide, which maps each state's rule; where a state's clock is shorter than HIPAA's, that state's clock governs its residents.
Is anything I enter stored or shared?
No. The calculation runs entirely in your browser, the dates never leave your device, there is no account, no log, and nothing retained.