Notification clock

The regulatory time window (for example, GDPR Article 33's "without undue delay and, where feasible, not later than 72 hours") that begins running from an organization's awareness of a qualifying personal data breach, requiring notification to the relevant supervisory authority. The precise jurisdiction-by-jurisdiction analysis of who must be notified and when is owned by Topic 11.4. (see Topic 11.4)

A binding deadline for reporting an incident to a regulator, stated at clause level with its exact trigger event. The PDPA clock (s 26D(1)) runs from the day the organisation makes its s 26C assessment, not from the day of the breach; the MAS Notice FSM-N05 clock (para 7) runs from discovery of a relevant incident for banks, with parallel notices for other financial-institution sectors.

The legally mandated time window, most often triggered by a breach, within which an organization must notify a supervisory authority, affected individuals, or both, once it becomes aware of the incident. GDPR Article 33 sets a without-undue-delay standard with a 72-hour benchmark for notifying the supervisory authority; many jurisdictions set separate clocks for notifying affected individuals.