China requires companies to notify regulators within 4 hours of a particularly significant data breach, the fastest statutory deadline among the countries compared in this post, according to DLA Piper's Data Protection Laws of the World handbook (2026, 15th edition). Most other major jurisdictions still default to the European Union's 72-hour GDPR standard, but the underlying rules vary sharply once you look past that one shared number.
How fast must companies report a data breach in China?
4 hours is the deadline for China's most severe category of cybersecurity incident under the Measures for the Administration of the Reporting of Cybersecurity Incidents, which took effect November 1, 2025. China's rules sort incidents into four tiers, from general to particularly significant, with the 4-hour clock reserved for the top tier.
Figure 1: China's 4-hour deadline for its most severe breach category is the shortest statutory window compared in this post. Source: DLA Piper Data Protection Laws of the World handbook (2026).
No other country surveyed here comes close to matching that speed, which makes China the clear outlier rather than the emerging norm.
What is the standard breach notification deadline under GDPR?
72 hours is the deadline set by Article 33 of the GDPR: controllers must notify their supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to pose a risk to individuals. That same 72-hour figure shows up again and again once you compare deadlines across other jurisdictions, which is why it functions as the de facto global default.
Figure 2: Statutory deadline to notify the regulator, in hours, for the five countries in this comparison that set a fixed hour-based window. Source: DLA Piper Data Protection Laws of the World handbook (2026).
Sites that collect data from EU residents cannot treat this as a soft guideline. For the fuller enforcement picture behind that number, see our data breach statistics roundup, which tracks incident volumes alongside notification rules.
Which countries also require notice within 72 hours?
Three more jurisdictions in this comparison set their regulator deadline at exactly 72 hours. The Philippines requires the National Privacy Commission and affected individuals to both be notified within 72 hours of the controller's knowledge or reasonable belief that a breach has occurred. South Korea's PIPA sets the same 72-hour window when a breach affects 1,000 or more people, involves sensitive or unique identifying information, or results from unauthorized external access. India's DPDP Act requires an initial notice "without delay" followed by a detailed report to the Data Protection Board within 72 hours.
Figure 3: How the 8 countries compared in this post split across notification deadline models. Source: DLA Piper Data Protection Laws of the World handbook (2026).
Four of the eight countries surveyed land on exactly 72 hours, which is the strongest sign that this figure, not China's 4-hour rule, is the number most privacy teams should plan around by default.
How does China's 4-hour deadline compare to the 72-hour benchmark?
4 hours is just a fraction of the 72-hour window most other countries allow. Measured against that global benchmark, China's rule gives companies roughly 5.6% of the time window that GDPR, the Philippines, South Korea, and India all provide for the same kind of decision: confirming a breach, assessing its scope, and getting a notice in front of a regulator.
Figure 4: China's 4-hour deadline plotted against the 72-hour standard used by four of the other seven countries compared in this post. Source: DLA Piper Data Protection Laws of the World handbook (2026).
A company with incident response processes built around a 72-hour clock would already be in breach of China's requirement before it finished its first internal review.
How does Brazil's two-stage breach notification deadline work?
3 working days is what Brazil's LGPD gives controllers for an initial notice to the national data protection authority, ANPD, when a breach is likely to cause risk or harm. If the full details are not yet known, a preliminary notice can be filed instead, with up to 20 further working days allowed to submit the complete report, for a maximum window of 23 working days from awareness to final report. The Philippines runs a similar two-stage structure: the initial 72-hour notice, then a complete breach report due within 5 additional days.
Figure 5: Initial notice deadline versus the full report deadline, in days, for Brazil and the Philippines, the two countries in this comparison with an explicit two-stage reporting structure. Source: DLA Piper Data Protection Laws of the World handbook (2026).
Two-stage deadlines like these give responding teams breathing room to investigate without missing the clock entirely, which is closer to how most real incident timelines actually unfold.
If your site collects personal data from users in any of these jurisdictions, the underlying privacy policy needs to reflect which authority you would notify and how fast. A privacy policy generator built to track current breach notification obligations keeps that section current without a manual rewrite every time a country updates its deadline.
Which countries have no fixed breach notification deadline?
Australia and Canada are the two outliers in this comparison that set no fixed clock at all. Australia's Privacy Act requires organizations to assess, within 30 calendar days, whether a suspected incident qualifies as an "eligible data breach," but it does not set a specific deadline for notifying the regulator once that assessment confirms one occurred. Canada's federal PIPEDA and Alberta's PIPA both require notice "without unreasonable delay," a standard that depends on the facts of each case rather than a stated number of hours or days.
A risk-based standard gives regulators room to weigh severity, but it also means two similar breaches in Australia or Canada could see very different notification timelines depending on how each company interprets "without unreasonable delay."
How do breach notification deadlines compare across countries?
| Country | Regulator deadline | Legal basis | Source year |
|---|---|---|---|
| China | 4 hours (most severe incidents) | Cybersecurity Incident Reporting Measures | 2026 |
| European Union | 72 hours | GDPR Article 33 | 2026 |
| Philippines | 72 hours | Data Privacy Act / NPC rules | 2026 |
| South Korea | 72 hours (1,000+ affected or sensitive data) | PIPA | 2026 |
| India | 72 hours (detailed report) | DPDP Act | 2026 |
| Brazil | 3 working days, up to 23 total | LGPD | 2026 |
| Australia | No fixed deadline (30-day assessment window) | Privacy Act 1988 | 2026 |
| Canada | No fixed deadline ("without unreasonable delay") | PIPEDA / Alberta PIPA | 2026 |
Source: DLA Piper Data Protection Laws of the World handbook, 2026 edition, per-country breach notification entries.
The Bottom Line
72 hours is still the closest thing to a global default for breach notification, used by 4 of the 8 countries compared here, but treating it as a universal rule is a mistake. China's 4-hour window for its most severe incidents leaves almost no room for a slow internal review process, Brazil's working-day structure can stretch a deadline calculation in ways a calendar-day countdown would not, and Australia and Canada skip a fixed number entirely in favor of a risk-based standard. A company operating across more than one of these jurisdictions needs its incident response plan built around the shortest deadline it is exposed to, not the most common one.
Frequently Asked Questions
What is the fastest data breach notification deadline in the world? 4 hours. China requires companies to report particularly significant cybersecurity incidents to regulators within 4 hours of becoming aware of them, under rules effective November 2025, according to DLA Piper's Data Protection Laws of the World handbook (2026).
What is the standard data breach notification deadline under GDPR? 72 hours. Article 33 of the GDPR requires controllers to notify their supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach. The Philippines, South Korea, and India all use the same 72-hour benchmark.
Which countries have no fixed data breach notification deadline? Australia and Canada. Australia's Privacy Act only requires organizations to assess within 30 days whether a breach is eligible for notification, with no fixed deadline for notifying the regulator once it is confirmed. Canada's federal and Alberta laws require notice without unreasonable delay, but neither sets a specific number of hours or days.
How long does Brazil give companies to report a data breach? 3 working days for an initial notice to Brazil's ANPD, with up to 20 further working days allowed to submit a complete report, for a maximum window of 23 working days if the full details are not available up front.
Where the Numbers Come From
- DLA Piper. (2026). "Data Protection Laws of the World: Breach Notification, China." 4-hour deadline for particularly significant incidents under the Measures for the Administration of the Reporting of Cybersecurity Incidents, effective November 1, 2025.
- DLA Piper. (2026). "Data Protection Laws of the World: Breach Notification, Germany/EU." GDPR Article 33's 72-hour notification standard.
- DLA Piper. (2026). "Data Protection Laws of the World: Breach Notification, Brazil." LGPD's 3-working-day initial notice and 20-working-day supplementary window.
- DLA Piper. (2026). "Data Protection Laws of the World: Breach Notification, Australia." 30-day eligible-breach assessment window under the Privacy Act 1988.
- DLA Piper. (2026). "Data Protection Laws of the World Handbook, 15th Edition." More than 160 jurisdictions tracked, updated twice yearly.
Note: All figures verified as of October 2026, drawn from DLA Piper's Data Protection Laws of the World handbook, 15th edition. Breach notification deadlines change as countries amend their laws; this post is refreshed at least twice a year alongside the handbook's own update cycle.
