How quickly do you notify a data breach?
Within 48 hours once a suspected breach is judged likely, within 72 hours once confirmed, and a written summary within ten business days of resolution, per the DPA.
The DPA commits to notice of a personal data breach affecting customer personal data within forty-eight hours once one is suspected and judged likely to be confirmed, and within seventy-two hours once confirmed, with the information you need to meet your own notification obligations. A written summary of impact, cause, remediation, and preventive actions follows within ten business days of resolution. See the DPA.
Written for it and security, finance and procurement. Last reviewed 2026-09-15.
Related questions
Still need an answer?
Tell us what you were looking for and we reply within one business day.
Contact the team →Running a security review?
Documents, controls, and the request form live in the Trust Center.
Open the Trust Center →