Breach notification
The legal obligation to inform regulators and affected individuals after a data breach, usually within a defined deadline.
Deadlines are tight and vary by regime: 72 hours under GDPR, 60 days to notify individuals of a HIPAA breach regardless of its size, and a patchwork of state laws in the US with their own thresholds and timelines. The 500-record threshold people remember governs when HHS is told, not when the individuals are.
The clock generally starts on discovery, not on completing your investigation, which is why forensic readiness matters. Without evidence of what was accessed, the cautious assumption is usually that everything was.
Where this comes up
Breach notification sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.