GDPR in america: Privacy Security Obligation Table
The Privacy Security Obligation Table carries 2 published figures read from 3 sources' own pages, from 60 to 60 day, read 26 September 2026.
Attestvio sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
3 of the 23 named sources read in full publish a figure; 20 publish none, read 26 September 2026.
By obligation
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| obligationHIPAA breach notice to the Secretary | 60day | 60 to 60day | 1 |
| obligationHIPAA business associate breach notice | 60day | 60 to 60day | 1 |
| obligationGDPR fine ceiling, lower tier | 10,000,000EUR | 10,000,000 to 10,000,000EUR | 1 |
| obligationGDPR fine ceiling, upper tier | 20,000,000EUR | 20,000,000 to 20,000,000EUR | 1 |
| obligationCCPA business revenue threshold | 26,625,000USD | 26,625,000 to 26,625,000USD | 1 |
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| CPPA announcement of the inflation-adjusted CCPA thresholds | 26,625,000USD | CCPA business revenue threshold | 2026-09-26 |
| EUR-Lex Regulation (EU) 2016/679 (GDPR) | 20,000,000EUR | GDPR fine ceiling, upper tier | 2026-09-25 |
| EUR-Lex Regulation (EU) 2016/679 (GDPR) | 10,000,000EUR | GDPR fine ceiling, lower tier | 2026-09-25 |
| HHS HIPAA Breach Notification Rule | 60day | HIPAA breach notice to the Secretary | 2026-09-26 |
| HHS HIPAA Breach Notification Rule | 60day | HIPAA business associate breach notice | 2026-09-26 |
The sentence each figure was read from (5)
- CPPA announcement of the inflation-adjusted CCPA thresholds, read 2026-09-26:
Annual gross revenue amount within the definition of “business” $26,625,000 $25,000,000
- EUR-Lex Regulation (EU) 2016/679 (GDPR), read 2026-09-25:
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
- EUR-Lex Regulation (EU) 2016/679 (GDPR), read 2026-09-25:
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
- HHS HIPAA Breach Notification Rule, read 2026-09-26:
If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.
- HHS HIPAA Breach Notification Rule, read 2026-09-26:
A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.
Read in full, publishes no figure
20 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- ICO data protection officers, read 2026-09-26: read in full and no accepted figure on the page
- ICO personal data breach reporting, read 2026-09-11: read in full and no accepted figure on the page
- ICO encryption guidance, read 2026-09-11: read in full and no accepted figure on the page
- ICO right to erasure, read 2026-09-26: read in full and no accepted figure on the page
- ICO enforcement action, read 2026-09-18: every candidate on the page was refused
- Data Protection Act 2018, read 2026-09-26: read in full and no accepted figure on the page
- HHS HIPAA Security Rule guidance material, read 2026-09-11: every candidate on the page was refused
- HHS business associate contracts, read 2026-09-12: read in full and no accepted figure on the page
- HHS HIPAA enforcement highlights, read 2026-09-11: read in full and no accepted figure on the page
- California Attorney General CCPA, read 2026-09-11: read in full and no accepted figure on the page
- California Privacy Protection Agency law and regulations, read 2026-09-11: read in full and no accepted figure on the page
- OAIC notifiable data breaches (Australia), read 2026-09-11: read in full and no accepted figure on the page
- EDPB guidelines, recommendations and best practices, read 2026-09-26: read in full and no accepted figure on the page
- FTC privacy and security business guidance, read 2026-09-26: read in full and no accepted figure on the page
- PCI SSC about, read 2026-09-11: read in full and no accepted figure on the page
- OSHA recordkeeping, read 2026-09-11: read in full and no accepted figure on the page
- SEC Division of Examinations, read 2026-09-26: read in full and no accepted figure on the page
- FCA Handbook SYSC, read 2026-09-26: read in full and no accepted figure on the page
- FFIEC IT handbook information security booklet, read 2026-09-11: read in full and no accepted figure on the page
- the authority per jurisdiction per obligation, read 2026-09-26: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 23 named sources that could be read published a usable figure; 20 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 21 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per obligation, quoted verbatim from the regulator or the statute with its effective date; the comparison across regimes is the figure - which regime gives the shortest breach clock, which sets a DPO threshold at all, which caps a fine at a percentage of turnover, and which of them changed this year.
Changed-since the previous read, which is the news when a threshold is inflation-adjusted or a rulemaking package takes effect.
21 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (23)
- EUR-Lex Regulation (EU) 2016/679 (GDPR)(the publisher's own terms; quoted for reporting and comment)
- ICO data protection officers(the publisher's own terms; quoted for reporting and comment)
- ICO personal data breach reporting(the publisher's own terms; quoted for reporting and comment)
- ICO encryption guidance(the publisher's own terms; quoted for reporting and comment)
- ICO right to erasure(the publisher's own terms; quoted for reporting and comment)
- ICO enforcement action(the publisher's own terms; quoted for reporting and comment)
- Data Protection Act 2018(the publisher's own terms; quoted for reporting and comment)
- HHS HIPAA Breach Notification Rule(the publisher's own terms; quoted for reporting and comment)
- HHS HIPAA Security Rule guidance material(the publisher's own terms; quoted for reporting and comment)
- HHS business associate contracts(the publisher's own terms; quoted for reporting and comment)
- HHS HIPAA enforcement highlights(the publisher's own terms; quoted for reporting and comment)
- California Attorney General CCPA(the publisher's own terms; quoted for reporting and comment)
- California Privacy Protection Agency law and regulations(the publisher's own terms; quoted for reporting and comment)
- CPPA announcement of the inflation-adjusted CCPA thresholds(the publisher's own terms; quoted for reporting and comment)
- OAIC notifiable data breaches (Australia)(the publisher's own terms; quoted for reporting and comment)
- EDPB guidelines, recommendations and best practices(the publisher's own terms; quoted for reporting and comment)
- FTC privacy and security business guidance(the publisher's own terms; quoted for reporting and comment)
- PCI SSC about(the publisher's own terms; quoted for reporting and comment)
- OSHA recordkeeping(the publisher's own terms; quoted for reporting and comment)
- SEC Division of Examinations(the publisher's own terms; quoted for reporting and comment)
- FCA Handbook SYSC(the publisher's own terms; quoted for reporting and comment)
- FFIEC IT handbook information security booklet(the publisher's own terms; quoted for reporting and comment)
- the authority per jurisdiction per obligation(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Privacy Security Obligation Table carries 2 published figures read from 3 sources' own pages, from 60 to 60 day, read 26 September 2026.
3 of the 23 named sources read in full publish a figure; 20 publish none, read 26 September 2026.
Privacy Security Obligation Table, obligation HIPAA breach notice to the Secretary: median 60 day across 1 source, read 26 September 2026.
Privacy Security Obligation Table, obligation HIPAA business associate breach notice: median 60 day across 1 source, read 26 September 2026.
Privacy Security Obligation Table, obligation GDPR fine ceiling, lower tier: median 10,000,000 EUR across 1 source, read 26 September 2026.
Privacy Security Obligation Table, obligation GDPR fine ceiling, upper tier: median 20,000,000 EUR across 1 source, read 26 September 2026.
Privacy Security Obligation Table, obligation CCPA business revenue threshold: median 26,625,000 USD across 1 source, read 26 September 2026.
Cite as: "Attestvio Privacy Security Obligation Table", updated 2026-10-05, https://attestvio.com/datasets/privacy-security-obligation-table/.
Download the CSV (5 rows, computed 2026-10-05)