#data-breach-notification

#data-breach-notification

Regulations such as the General Data Protection Regulation (GDPR) and the Australian Prudential Regulation Authority's (Apra's) CPS 230 standard have led organisations to become "really obsessed" with the 72-hour notification window following a data breach, according to Shannon Murphy, global security and risk strategist at Trend Micro.

What's Changed Under SB 446 Previously, California law required businesses to notify affected individuals of data breaches "without unreasonable delay." Under SB 446, businesses must notify affected individuals within 30 calendar days of discovering or being notified of a data breach. However, the law includes some flexibility to accommodate the practical realities of incident response. Specifically, businesses may delay notification when necessary for legitimate law enforcement purposes or to determine the full scope of the breach and restore the integrity of data systems.