Breach notification clock

Set the hour you became aware and see when each regulator expects to hear from you. Built because the first hour of an incident is the worst possible time to be reading a statute, and because these deadlines run in parallel, not in sequence.

Everything you type stays in this tab. Share copies a link, never your inputs, unless the tool says it encodes them in the URL.

Aware at

Awareness, not discovery of the full scope. The clock does not wait for your investigation.

Shown in

Which apply India: CERT-In directions (6 hours) India: DPDP Act, Data Protection Board and affected people EU/UK GDPR: supervisory authority (72 hours) GDPR: affected individuals, where the risk is high RBI regulated entity (2 to 6 hours) SEBI regulated entity (6 hours) Customer contracts (commonly 24 to 72 hours) Cyber insurance notification

Who	Deadline	Time left

This is a planning aid, not legal advice. The exact trigger, the definition of awareness and the reporting route differ by regulator, by sector and by the facts. Your counsel decides; this just stops the clock being a surprise. Check the current text of each rule, as several of these have changed in the last few years.