GDPR vs HIPAA breach notification

The GDPR asks the controller to notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals (Article 33(1)). The clock is tied to awareness, not to the date the breach started, so the practical question is when your organization can reasonably say it knows a breach has occurred. For a health tech company holding EU personal data alongside US PHI, the 72 hours run from the first moment a relevant person in the EU-facing business can identify a personal data breach. A forensic investigation that takes days does not stop the clock. Decide in advance who triages suspected incidents, how fast they escalate, and who can make the risk call that determines whether notice is required at all.

When notice is late, Article 33 requires the controller to explain the reasons for the delay, so the timeline itself becomes evidence. Your incident records should therefore capture the time of first detection, the time of escalation, the time the risk assessment was made and the reasons for any pause. Confirm with your data protection officer or legal counsel how your internal policy defines awareness for processors and sub-processors, since a processor's knowledge can affect when the controller is treated as aware. Article 32 sets the security of processing duties that make early detection possible in the first place, and Articles 33 and 34 cover notice to the supervisory authority and to individuals. Map your monitoring, logging and on-call paths to those articles so the same alert can start both the GDPR and HIPAA processes.

The clocks also diverge in how they can slip. The GDPR allows notice after 72 hours only where the controller gives reasons, while the HIPAA individual notice window runs up to 60 calendar days from discovery under 45 CFR 164.404. Those two rules do not offset each other, so a HIPAA delay does not excuse a GDPR delay. Build a single incident record that stamps the awareness time used for the GDPR decision and the discovery time used for HIPAA, and have counsel confirm how each is measured for your data flows. Run a tabletop exercise that starts the clock from a realistic alert, not from a confirmed root cause, and record how long the triage and risk assessment take. Those measurements, not the regulatory maximums, show whether your process can meet 72 hours in practice.

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, identifying each affected individual where possible (45 CFR 164.410). That 60-day ceiling is the vendor's outer limit, not a planning target. The covered entity still owes its own individual notice within 60 calendar days of discovery (45 CFR 164.404), and the clock for that notice does not wait for the vendor. A vendor that reports on day 55 leaves the company only days to verify scope, identify individuals and prepare letters, which is why the vendor's delay directly compresses the company's own response. Business associate contracts must also require the vendor to report security incidents it becomes aware of, including breaches under 164.410 (45 CFR 164.314(a)(2)(i)(C)). Confirm that your contracts name a specific reporting window shorter than the regulatory ceiling and state what information the vendor must supply first.

The discovery rule is the detail most often misread. A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent of the covered entity other than the person committing the breach (45 CFR 164.404). For a business associate acting as an agent, its knowledge can start the covered entity's clock, so a vendor that logs an alert on a Monday and reports on a Friday may already have consumed days the company expected to have. Ask each business associate how it triages alerts, who is accountable for escalation outside business hours, and whether its incident tooling records the first time a suspicious event was seen, not only when it was confirmed. Those timestamps decide whether the company's own clock started earlier than it assumed.

For an incident that touches both EU personal data and US PHI, the GDPR 72-hour supervisory authority deadline and the HIPAA 60-day individual clock can run on different starting points, so one incident process should key every step to the earliest discovery timestamp it can establish. Illustratively, if a hosting vendor confirms exfiltration on day 3 but its first alert was on day 1, the company should plan its GDPR clock from the date it became aware, which the vendor's records may shift. Build the contract and runbook around three checks: a vendor notice window that leaves room for the company's own deadlines, a required field for first-detection time in each vendor report, and a named owner who decides whether the event is a breach under each regime. Confirm the exact notice content your counsel expects from each vendor before an incident occurs.

The breach clocks should shape your incident runbook, contracts and logging before you choose a compliance framework. Notification timing is the one requirement that fails in the moment, when no one has time to redesign anything. Where EU personal data and PHI share systems, the GDPR clock is usually the one to design around first. Under Article 33(1), the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to pose a risk to individuals. That deadline starts early, so the intake, triage and risk assessment steps in your runbook have to be fast enough to reach a notification decision inside it. The HIPAA 60-day limit runs later and governs notice to individuals and, for breaches of 500 or more people, contemporaneous reporting to HHS. Design for the shorter clock, then confirm the longer one still fits your process.

Three design choices follow. First, the runbook needs a single discovery record that captures the time a workforce member or agent first knew of the incident, because both regimes measure from that point. Second, your business associate contracts should require the vendor to report security incidents to you promptly, since HIPAA expects those contracts to cover breaches of unsecured PHI and your own 72-hour clock may start before the vendor's report reaches you. Third, logs must be detailed enough to show what data was affected, which individuals and which jurisdictions, so the notice content can be drafted within the early window. Confirm with your counsel and with each vendor how their contract terms and notice timelines match your own.

For the broader legal comparison, including scope, enforcement and documentation duties, read the sibling GDPR vs HIPAA page. For how fines are calculated and what moves an organization between penalty tiers, read the sibling GDPR vs HIPAA penalties page. This section only addresses the program design those clocks force.