How to use the data breach notification deadline calculator
There is no single federal data breach notification law in the United States. All fifty states plus the District of Columbia have their own statute, and sector rules sit on top of them. Enter when you discovered the breach and the rule that applies to see the outer deadline and how much time is left.
Legal basis — Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery (45 C.F.R. 164.404(b)); breaches affecting 500 or more individuals go to HHS and the media contemporaneously (45 C.F.R. 164.406, 164.408), while smaller ones are reported on an annual log. State statutes generally use the same without-unreasonable-delay standard with an outer cap, commonly 30 to 60 days, such as Florida at 30 days (Fla. Stat. 501.171) and Texas at 60 days (Tex. Bus. and Com. Code 521.053). The FTC Safeguards Rule requires financial institutions to notify the FTC within 30 days of a qualifying event (16 C.F.R. 314.4). Figures current as of September 2026.
The cap is an outer limit, not a target. If you can notify sooner, the delay itself can be the violation, so the editable field is there for the rule your state or regulator actually imposes.
This calculator is for reference only and is not legal advice. Consult a licensed attorney about your specific incident.
Frequently Asked Questions
Breach notification duties usually follow the residence of the affected individuals, so a multi-state incident can trigger several statutes at once with different caps, content requirements and attorney general notice rules. Most responders work to the shortest applicable deadline.
No. The rule requires notice without unreasonable delay, and 60 calendar days is the outside limit rather than a safe harbor. Regulators have treated avoidable delay inside that window as a violation, so document why each day of the investigation was necessary.