Data breach notification

The clock starts when you become aware. Give it that moment and where the affected people live, and it works out the deadline for each authority involved.

When did you become aware of the breach?

The clock runs from your awareness, not from the intrusion.

Where do the affected people live?

Tick everything that applies — it is rarely one jurisdiction.

Is the breach likely to harm the people in it?

Name, address, phone, date of birth: enough to build targeted scams.

Your obligations

Set the awareness time and the jurisdictions involved.

The calculation runs in your browser; no incident detail is sent anywhere.

What the notification must contain

A description of the incident and how it happened.
The categories of people affected and roughly how many.
An assessment of the likely consequences.
The measures taken to contain it and stop it recurring.

A tool for orienting on deadlines and duties, not legal advice. Reference texts: RGPD arts. 33 and 34, the Saudi PDPL and its implementing regulations art. 24, and Tunisian organic law 2004-63.

Three regimes, three different answers

Most companies know one — the country they are incorporated in. It is rarely the only one binding them.

GDPR — arts. 33 and 34

72 hours to notify the supervisory authority from awareness. Where the risk to individuals is high, art. 34 requires telling them too, without undue delay. Late notification is allowed, provided you give reasons for the delay.

Saudi PDPL — art. 24

72 hours to notify SDAIA, with no materiality threshold: you cannot decide a breach was too small to report. Individuals are told as soon as harm is possible.

Tunisia — law 2004-63

No breach-notification obligation on a fixed deadline. The text predates the GDPR and never acquired one. The tool says so instead of inventing a deadline.

The territorial trap

A Tunisian or Saudi company holding data on EU residents falls inside the GDPR wherever it is incorporated. “We are not in Europe” exempts nobody.

When it helps

On the day of an incident, to know who to tell and by when
Building a response plan before you need one
Checking whether a foreign subsidiary pulls you into another regime
Anchoring the crisis meeting to deadlines rather than impressions

Frequently asked

When exactly does the clock start?

At awareness, not at intrusion. A March intrusion discovered in August starts its 72 hours in August. The standard is a reasonable degree of certainty that a security incident compromised personal data: an unverified alert is not enough, a technical confirmation is.

What if I miss the 72 hours?

The GDPR explicitly contemplates late notification — it must then carry the reasons for the delay. The worst option is not notifying at all and having the authority learn of it another way, which turns an incident into a breach of duty.

Do I have to tell the customers themselves?

Under the GDPR, only where the risk to them is high (art. 34). Name, address, phone and date of birth together are usually enough to build convincing targeted scams, which pushes toward telling them. Under the Saudi PDPL, as soon as harm is possible. If you conclude it is not needed, document the reasoning — that is what you will be asked for.

What if no banking data was touched?

That lowers the risk of direct fraud, not the duty to notify the authority. An identity-and-contact dataset stays usable for credible phishing, where the attacker quotes your real address and your real orders.

Is my incident data sent anywhere?

No. It all runs in your browser; no detail leaves your machine.

A tool for orienting on deadlines and duties, not legal advice. Reference texts: GDPR arts. 33 and 34, the Saudi PDPL and its implementing regulations art. 24, and Tunisian organic law 2004-63.

For businesses

Could you say today what data you hold, and where?

Most teams spend the first day of an incident answering that question. We map data flows, instrument detection and automate the audit trail — so the countdown starts with answers rather than an investigation.

Talk to us Our services

Free tools