COMPLIANCE CLOCKS

The regulator's clock starts before the fix ships

A breach notification deadline does not wait for the postmortem. Incident Lake records when your team became aware, starts the GDPR 72-hour clock, and keeps the evidence you will need in one place. Whether and what to notify is always a human call.

Common EU notification timelines

Rule

What and when

Clock starts

In Incident Lake

GDPR Art. 33

Notify the supervisory authority without undue delay and, where feasible, within 72 hours

Becoming aware of the personal data breach

72-hour deadline calculated automatically

DORA initial notification (Delegated Reg. (EU) 2025/301, Art. 5)

Within 4 hours of classifying an ICT incident as major, and no later than 24 hours after becoming aware of it

Classification as major / awareness

Reference timeline. Ask us about tracking it in your workspace

DORA intermediate and final reports

Intermediate within 72 hours of the initial notification; final within 1 month of the latest intermediate report

Previous submission

Reference timeline. Drafts can be built from the incident record

NIS2 Directive Art. 23

Early warning within 24 hours, incident notification within 72 hours, final report within 1 month (as transposed by each Member State)

Becoming aware of a significant incident

Reference timeline. Ask us about tracking it in your workspace

Your own commitments

Customer contracts, SLAs and board escalation rules often run on tighter clocks than the law

Detection or declaration

SLA targets and stakeholder updates tracked on the incident

DORA has applied since 17 January 2025. NIS2 deadlines depend on national transposition. An EU proposal to change GDPR breach notification is under discussion and has not been adopted; 72 hours remains the rule.

From awareness to submission

Log the moment of awareness
Record when the team became aware and which rules may apply. Deadlines appear as cards on the incident.
Draft from the record
Timeline, scope and actions taken are already in the incident, so the agent can draft the report from facts your team confirmed during the response.
A person signs off
Your DPO or counsel reviews, exports to PDF or Word, and files through the regulator's own channel. The agent never submits anything externally.
Keep the evidence
Source PDFs live in the evidence library and are cited back as Verified Sources, so auditors can see what each statement rests on.

Pairs well with

Sites by country and region in the CMDB, mapped to the rules and to-dos that apply
Approval-gated stakeholder emails and a status page, all logged
Tabletop drills that rehearse the notification path before you need it

Start free →

Sources (accessed 26 October 2026)

This page is general information, not legal advice. Whether you must notify, by when and what to include depends on your facts and jurisdiction. Check your regulator's guidance and speak with qualified counsel.

The regulator's clock starts before the fix ships

Common EU notification timelines

From awareness to submission

Log the moment of awareness

Draft from the record

A person signs off

Keep the evidence

Pairs well with

Sources (accessed 26 October 2026)

Try Incident Lake with a free trial