Breach notification timer
Enter the moment you became aware of the incident and see your reporting deadlines under the GDPR and NIS2. The clock runs in this page only. Nothing is sent or saved, so keep your own record of the time.
GDPR, Article 33. If a personal data breach is likely to put people at risk, tell your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. If you are late, you must give the reasons. Breaches unlikely to result in a risk to people need not be notified, but should be documented.
NIS2, Article 23. For a significant incident: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the incident notification. Your national authority or CSIRT may set the exact process.
"Aware" generally means you have a reasonable degree of certainty that an incident has occurred. Whether an incident is "significant" or a breach is "likely to risk" is a judgment you must make and document.
Information only, not legal advice. Check the rules that apply in your country and with your own advisers.