Data Breach Notification Laws: GDPR's 72-Hour Rule vs CCPA | LegalAiAuditor Blog
A data breach is the moment compliance stops being theoretical. The notification clock starts the second you discover it, and GDPR and CCPA set meaningfully different requirements for what happens next.
GDPR: the 72-hour rule
Under Article 33 of the GDPR, organizations must notify their supervisory authority within 72 hours of becoming aware of a breach likely to result in risk to individuals' rights and freedoms. If the risk is high, affected individuals must also be notified directly, without undue delay.
CCPA: notification tied to state breach law
CCPA itself doesn't set a specific notification deadline -- breach notification for California residents is governed by California's separate data breach notification statute, enforced through the California Attorney General's data breach reporting requirements, which requires notification "in the most expedient time possible and without unreasonable delay."
What counts as a "breach"
Both frameworks define breach broadly -- unauthorized access, disclosure, alteration, or loss of personal data, whether malicious or accidental (a misconfigured database left publicly accessible counts, even with no evidence of misuse).
Why this matters before it happens
The 72-hour GDPR clock is brutally short if you don't already know what personal data you hold, where it lives, and who to contact. The single highest-leverage preparation step is an accurate, current data inventory -- most of the mistakes we cover in common privacy policy mistakes stem from organizations not actually knowing their own data flows.
Reduce your exposure surface
Fewer unnecessary data collection points mean less to report if something goes wrong. Run a free audit to see what personal data your site is actually collecting and where it's exposed.