Incident reporting
Notifying regulators, and sometimes customers, of security, operational or data incidents within set deadlines.
Overview
Deadlines vary widely: 72 hours for personal data breaches under the GDPR, 72 hours under NYDFS Part 500, and multi-stage reporting under DORA. Missing the clock is itself a breach.
It connects most directly to Incident response, DORA, NYDFS Part 500 and GDPR.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Incident deadlines run on hours, not weeks.
Who it affects
Financial firms, data controllers, critical infrastructure and public companies.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to Incident reporting. Select one to open it.
What to do about it
- 1Define the owner, frequency, data and pass condition.
- 2Automate the test on source data where you can.
- 3Capture evidence on every run, including exceptions.
- 4Review exceptions and failures and record the decision.
From requirement to evidence.
Every applicable reporting clock starts automatically when an incident is logged.
Request early access →