Reference · Frameworks
The rules your firm answers to, mapped to what we find.
The privacy and breach-notification rules that apply to owner-run firms, grouped by jurisdiction, each with its deadline.
Frameworks 8Updated 15 Oct 2026By LeakTrace
Deadlines at a glance
How long each rule gives you to report.
United States, federal
60 days
60 days to affected individuals; 60 days to HHS for breaches of 500+
California
Most expedient time possible
Notification to Attorney General for 500+ residents; individual notification "in the most expedient time possible"
Each deadline is a summary of the rule as recorded on its page. The authoritative source is linked from every framework page; read it, or ask counsel, before relying on a deadline.
Canada, federal
Canada, provinces
Quebec Law 25
Quebec's modernized privacy regime, phased in 2022-2024.Updated 15 Oct 2026
Deadline
Promptly, with diligence
United States, federal
SEC Item 1.05
SEC rules requiring public companies to disclose material cybersecurity incidents on Form 8-K within four business days of materiality determination, and to describe cybersecurity risk management, strategy, and governance in annual reports.Updated 29 Sep 2026
Deadline
4 business days
United States, states
CCPA / CPRA
California's omnibus consumer privacy law, effective 2020 and expanded by CPRA in 2023.Updated 15 Oct 2026
Deadline
Most expedient time possible
NYDFS Part 500
New York Department of Financial Services (NYDFS) cybersecurity regulation.Updated 29 Sep 2026
Deadline
72 hours
Standards
SOC 2
AICPA reporting framework for service organizations.Updated 29 Sep 2026
Deadline
No fixed deadline
The outside watch for your firm: see what is open before anyone else does, with the proof for the lead finding. Check my firm →