Breach notification
Also called breach reporting, incident notification, breach disclosure
A legal duty to tell a regulator, and sometimes the people affected, about a security incident within a set time.
Many laws require an organisation to report a security incident, and each one sets a clock. What starts the clock differs. EU data protection law counts from the moment the organisation becomes aware of a breach of personal data. The US rule for listed companies counts from the decision that an incident is material, which can come later.
In EU data protection law a breach includes an accidental disclosure, so an AI assistant that shows one customer another's records can be a breach with no intruder involved. When the risk to people is high, they have to be told as well as the regulator.
Decide before an incident who makes the call and which clock is the shortest that could apply. 72 hours goes quickly when the first day is spent finding out what happened.
For example
An AI assistant shows customers each other's records on Monday. Under EU data protection law the company has 72 hours to tell its regulator.
Put it to use
Where you'll meet breach notification in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.