Data breach reporting is the process of notifying regulators and, in some cases, affected individuals when a personal-data incident meets legal notification criteria. Under the GDPR, organizations generally notify the relevant supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to pose a risk to people’s rights and freedoms. Individuals must be informed without undue delay when the breach is likely to create a high risk. Requirements and deadlines vary by jurisdiction.
In practice, organizations need incident-response procedures that identify what data was exposed, assess potential harm, preserve evidence, and route decisions to the people responsible for notification. Attackers may steal or disclose personal data through ransomware, compromised accounts, or exploited systems. Clear logs, escalation paths, and documented risk assessments help teams meet deadlines and explain their decisions; reporting does not replace containing the incident or securing affected systems.