Global cyber incident reporting deadlines

The deadlines at a glance

If you operate internationally, one incident can start several clocks. The UK's Cyber Security and Resilience Bill (CSRB) would add a 24-hour and 72-hour timetable alongside existing rules. These are the headline deadlines for the main regimes.

Regime	First deadline	Next deadline	Status
UK: Cyber Security and Resilience Bill	24 hours	Full report at 72 hours	Not yet law
UK: UK GDPR	72 hours, where feasible	Further information in phases	In force
UK: Telecoms security	As soon as reasonably practicable	None stated in the section	In force
UK: FCA and PRA operational incidents	Check final rules	Check final rules	From 18 March 2027
EU: NIS2	24 hours (early warning)	72 hours, then a final report within one month	Check each member state's law
EU: DORA	4 hours after classifying as major, and no later than 24 hours after detection	72 hours, then a final report within one month	In force
EU: GDPR	72 hours, where feasible	Further information in phases	In force
EU: Cyber Resilience Act	24 hours (actively exploited vulnerabilities and severe incidents)	72 hours, then a final report	Reporting from 11 September 2026
US: CIRCIA	72 hours (incidents), 24 hours (ransom payments)	Updates as required	Final rule not in effect at last check
US: SEC, listed companies	4 business days after deciding an incident is material	Amendments as needed	In force
Australia: SOCI Act	12 hours (significant impact), 72 hours (relevant impact)	Written record after a verbal report	In force
Australia: Cyber Security Act 2024	72 hours after a ransomware payment	None	In force

These are summaries. Each regime has its own scope tests and exceptions, so check the source or take local advice before relying on them.

The clock usually matters more than the number

What starts the clock varies.

• The Bill: first aware that a reportable incident has occurred or is occurring.
• UK GDPR: becoming aware of the breach.
• DORA: classification of a major incident, with an outer limit based on detection.
• SEC: determining that the incident is material, which is meant to happen without unreasonable delay.
• CIRCIA: reasonably believing a covered incident has occurred.
• Australia's ransomware rule: making the payment or learning that one was made.

The tests also differ. The Bill looks at the significance of the impact on a service. GDPR looks at risk to people. The SEC looks at materiality to investors. An incident can meet one test and not another.

"Hours" can include weekends. The Bill and many others count hours and don't pause for non-working days. Check whether each regime you face counts business days.

How the UK's model compares

The Bill's 24-hour and 72-hour structure looks similar to NIS2, but they differ in three ways:

• Starting point. Both of the Bill's periods run from the same moment.
• Final report. NIS2 expects a final report within one month. The Bill's text has no equivalent general final report stage.
• Recipient. Under the Bill, you notify your regulator and copy the CSIRT at the same time. NIS2 routes reports to the CSIRT or competent authority, depending on national law.

See our NIS2 comparison for wider differences.

Building a process for several regimes

1. List regimes per legal entity and service. Don't apply one global timetable to everyone.
2. Create a one-page matrix. Show trigger, deadline, recipient, form and owner for each.
3. Plan to the shortest relevant clock. If you may face DORA's 4-hour rule, triage must happen faster than a 24-hour process would require.
4. Record separate timestamps. Log detection, classification, awareness and each report.
5. Keep a single set of facts. Regulators may share information, so inconsistent reports cause problems.
6. Reuse content carefully. Our 24-hour template can form the core, but each regulator's form takes priority.
7. Pre-arrange local advice. Cross-border disclosure can raise legal and privilege issues.
8. Test across time zones. Run an exercise that starts outside UK working hours.

Do you need to report to everyone?

Usually not. Start with where you are established, where you provide regulated services, who your customers are and whether personal data is involved. Non-UK businesses should also read our overseas companies guide. UK firms should check NIS2 and DORA.

What may change

• The Bill's timetable could change in the final Act.
• CISA sent a draft CIRCIA final rule for review on 1 October 2026, and its effective date is not set.
• The UK has proposed a separate ransomware reporting duty.
• The FCA and PRA regime starts in March 2027, so check the final timings in the rulebooks.

Sources

• The Bill as brought from the Commons (HL Bill 32), regulation 11
• ICO: personal data breaches
• Communications Act 2003, section 105K
• FCA: PS26/2
• EUR-Lex: NIS2, DORA and Cyber Resilience Act
• Hunton: CISA's CIRCIA timetable
• Federal News Network: CIRCIA rule timing
• SEC: cyber disclosure rule
• Australian Cyber Security Centre: report an incident
• MinterEllison: Australian ransomware payment reporting