What is the typical breach notification window under many data protection regimes?

• A. Within 24 hours of discovery.
• B. Within 7 days of discovery.
• C. Typically within 72 hours of becoming aware of the breach.
• D. Within 30 days of breach occurrence.

Answer: (C)

Prompt notification is the focus here. Under many data protection regimes, the standard is to report a breach within 72 hours of becoming aware of it. This short window helps authorities and those affected respond quickly to contain damage, assess risk, and take remediation steps. A 24-hour window is typically too tight for proper detection and notification processes, while 7 days or 30 days delay action too long and increase potential harm. For example, GDPR requires reporting to the supervisory authority within 72 hours of becoming aware of a breach, with additional obligations to notify individuals when there is a high risk. While some regimes have variations, 72 hours is the most common default timeframe.