{
  "id": "reporting-deadlines",
  "title": "EU incident and breach reporting deadlines (GDPR, NIS2, DORA, CRA)",
  "description": "When each reporting clock starts, the deadlines, and who receives the reports.",
  "verified": "2026-10-19",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "attribution": "ClevSec (https://clevsec.one)",
  "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.",
  "human_readable": "https://clevsec.one/blog/nis2-incident-reporting/?ref=agent",
  "sources": [
    "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
    "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng",
    "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng",
    "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng",
    "https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng",
    "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf"
  ],
  "items": [
    {
      "regime": "GDPR",
      "event": "Personal data breach likely to result in a risk",
      "clock_starts": "When the controller becomes aware (reasonable degree of certainty, EDPB Guidelines 9/2022)",
      "reports": [
        {
          "report": "Notification to the supervisory authority",
          "deadline": "Without undue delay and, where feasible, within 72 hours",
          "reference": "GDPR Art. 33(1)"
        }
      ],
      "notes": "Information may be provided in phases (Art. 33(4)); late notifications must give reasons. Every breach is documented (Art. 33(5))."
    },
    {
      "regime": "GDPR",
      "event": "Personal data breach likely to result in a high risk",
      "clock_starts": "When the controller becomes aware",
      "reports": [
        {
          "report": "Communication to the people affected",
          "deadline": "Without undue delay",
          "reference": "GDPR Art. 34(1)"
        }
      ],
      "notes": "Exceptions in Art. 34(3): data unintelligible (e.g. encrypted), high risk no longer likely, or disproportionate effort (then a public communication)."
    },
    {
      "regime": "GDPR",
      "event": "Breach at a processor",
      "clock_starts": "When the processor becomes aware",
      "reports": [
        {
          "report": "Notification to the controller",
          "deadline": "Without undue delay",
          "reference": "GDPR Art. 33(2)"
        }
      ],
      "notes": "The controller is in principle aware once the processor has informed it (EDPB Guidelines 9/2022)."
    },
    {
      "regime": "NIS2",
      "event": "Significant incident (essential and important entities)",
      "clock_starts": "When the entity becomes aware of the significant incident",
      "reports": [
        {
          "report": "Early warning to the CSIRT or competent authority",
          "deadline": "Without undue delay and within 24 hours",
          "reference": "NIS2 Art. 23(4)(a)"
        },
        {
          "report": "Incident notification",
          "deadline": "Without undue delay and within 72 hours (24 hours for trust service providers on their trust services)",
          "reference": "NIS2 Art. 23(4)(b)"
        },
        {
          "report": "Intermediate report",
          "deadline": "On request of the CSIRT or authority",
          "reference": "NIS2 Art. 23(4)(c)"
        },
        {
          "report": "Final report",
          "deadline": "Not later than one month after the incident notification; a progress report instead if the incident is ongoing",
          "reference": "NIS2 Art. 23(4)(d)-(e)"
        }
      ],
      "notes": "Significant = severe operational disruption or financial loss for the entity, or considerable damage to others (Art. 23(3)). Digital providers: thresholds in Implementing Regulation (EU) 2024/2690."
    },
    {
      "regime": "DORA",
      "event": "Major ICT-related incident (financial entities)",
      "clock_starts": "Classification as major; and awareness for the 24-hour cap",
      "reports": [
        {
          "report": "Initial notification",
          "deadline": "Within 4 hours of classification as major and no later than 24 hours after becoming aware; if classified later, within 4 hours of classification",
          "reference": "RTS 2025/301 Art. 5(1)(a), 5(2)"
        },
        {
          "report": "Intermediate report",
          "deadline": "Within 72 hours of the initial notification; updated when regular activities are recovered",
          "reference": "RTS 2025/301 Art. 5(1)(b)"
        },
        {
          "report": "Final report",
          "deadline": "Within one month of the latest intermediate report",
          "reference": "RTS 2025/301 Art. 5(1)(c)"
        }
      ],
      "notes": "Major-incident criteria: see dataset dora-major-incident-criteria. Clients are informed without undue delay if their financial interests are affected (DORA Art. 19(3))."
    },
    {
      "regime": "CRA",
      "event": "Actively exploited vulnerability in a product with digital elements (manufacturers)",
      "clock_starts": "When the manufacturer becomes aware",
      "reports": [
        {
          "report": "Early warning via the ENISA single reporting platform",
          "deadline": "Within 24 hours",
          "reference": "CRA Art. 14(2)(a)"
        },
        {
          "report": "Vulnerability notification",
          "deadline": "Within 72 hours",
          "reference": "CRA Art. 14(2)(b)"
        },
        {
          "report": "Final report",
          "deadline": "No later than 14 days after a corrective or mitigating measure is available",
          "reference": "CRA Art. 14(2)(c)"
        }
      ],
      "notes": "Applies since 11 September 2026, also to products placed on the market before 11 December 2027 (Art. 69(3), 71(2))."
    },
    {
      "regime": "CRA",
      "event": "Severe incident having an impact on the security of the product (manufacturers)",
      "clock_starts": "When the manufacturer becomes aware",
      "reports": [
        {
          "report": "Early warning",
          "deadline": "Within 24 hours",
          "reference": "CRA Art. 14(4)(a)"
        },
        {
          "report": "Incident notification",
          "deadline": "Within 72 hours",
          "reference": "CRA Art. 14(4)(b)"
        },
        {
          "report": "Final report",
          "deadline": "Within one month after the incident notification",
          "reference": "CRA Art. 14(4)(c)"
        }
      ],
      "notes": "Impacted users are informed, where appropriate in a machine-readable format (Art. 14(8))."
    }
  ]
}