Personal data breach
Who must be notified when the data leaks, and within what deadline?
EU
Dataskyddsförordningen
art. 33 och 34
The supervisory authority is notified where there is a risk to the individual, and the individual where the risk is high.
- Deadline
- 72 hours from becoming aware of the breach
- Penalty
- Up to EUR 10 million or two percent of global turnover
- Supervision
- Integritetsskyddsmyndigheten
- Read
- 2026-08-22
United States
California Civil Code, delstatlig anmälningsplikt
Cal. Civ. Code § 1798.82
Notice to affected residents in the most expedient time possible. There is no general federal duty, sectoral rules apply alongside.
- Deadline
- Without unreasonable delay, no fixed hour limit
- Penalty
- Civil penalty per violation
- Supervision
- Delstatens justitiekansler
- Read
- 2026-08-22
China
Personal Information Protection Law
art. 57
Immediate measures are taken and the authority and individuals are notified. Notice to individuals may be withheld where measures prevent harm.
- Deadline
- Immediately, with further deadlines in the network data regulations
- Penalty
- Order to rectify, warning, suspension of the service and a fine
- Supervision
- Cyberspace Administration of China
- Read
- 2026-08-22
Connections
Sources and review
Register version crossover-v1.0.0 · Read 2026-08-22
This page restates written law with the provision and the official source. It is not legal advice in an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.