{ "name": "Attestvio Privacy Security Obligation Table", "title": "Privacy Security Obligation Table", "url": "https://attestvio.com/datasets/privacy-security-obligation-table/", "csv": "https://attestvio.com/datasets/privacy-security-obligation-table.csv", "markdown": "https://attestvio.com/datasets/privacy-security-obligation-table/index.md", "computed_at": "2026-10-05", "license": "https://attestvio.com/terms", "headline": "The Privacy Security Obligation Table carries 2 published figures read from 3 sources' own pages, from 60 to 60 day, read 26 September 2026.", "quotes": [ "The Privacy Security Obligation Table carries 2 published figures read from 3 sources' own pages, from 60 to 60 day, read 26 September 2026.", "3 of the 23 named sources read in full publish a figure; 20 publish none, read 26 September 2026.", "Privacy Security Obligation Table, obligation HIPAA breach notice to the Secretary: median 60 day across 1 source, read 26 September 2026.", "Privacy Security Obligation Table, obligation HIPAA business associate breach notice: median 60 day across 1 source, read 26 September 2026.", "Privacy Security Obligation Table, obligation GDPR fine ceiling, lower tier: median 10,000,000 EUR across 1 source, read 26 September 2026.", "Privacy Security Obligation Table, obligation GDPR fine ceiling, upper tier: median 20,000,000 EUR across 1 source, read 26 September 2026.", "Privacy Security Obligation Table, obligation CCPA business revenue threshold: median 26,625,000 USD across 1 source, read 26 September 2026." ], "citation": "\"Attestvio Privacy Security Obligation Table\", updated 2026-10-05, https://attestvio.com/datasets/privacy-security-obligation-table/.", "changed_since": null, "national": { "unit": "day", "n": 2, "median": 60, "min": 60, "max": 60, "p25": null, "p75": null, "mean": 60, "units": { "EUR": 2, "USD": 1, "day": 2 }, "published_sources": 3, "named_sources": 23, "read_sources": 23, "not_published": 20, "published_share": 0.13 }, "by_axis": { "obligation": { "HIPAA breach notice to the Secretary": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "HIPAA business associate breach notice": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "GDPR fine ceiling, lower tier": { "EUR": { "n": 1, "median": 10000000, "min": 10000000, "max": 10000000, "p25": 10000000, "p75": 10000000, "mean": 10000000 } }, "GDPR fine ceiling, upper tier": { "EUR": { "n": 1, "median": 20000000, "min": 20000000, "max": 20000000, "p25": 20000000, "p75": 20000000, "mean": 20000000 } }, "CCPA business revenue threshold": { "USD": { "n": 1, "median": 26625000, "min": 26625000, "max": 26625000, "p25": 26625000, "p75": 26625000, "mean": 26625000 } } } }, "rows": [ { "source": "HHS HIPAA Breach Notification Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA breach notice to the Secretary" }, "retrieved_at": "2026-09-26", "quote": "If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA Breach Notification Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA business associate breach notice" }, "retrieved_at": "2026-09-26", "quote": "A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "EUR-Lex Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "10 000 000 EUR", "value": 10000000, "unit": "EUR", "vat": null, "axis": { "obligation": "GDPR fine ceiling, lower tier" }, "retrieved_at": "2026-09-25", "quote": "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "EUR-Lex Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "20 000 000 EUR", "value": 20000000, "unit": "EUR", "vat": null, "axis": { "obligation": "GDPR fine ceiling, upper tier" }, "retrieved_at": "2026-09-25", "quote": "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "CPPA announcement of the inflation-adjusted CCPA thresholds", "url": "https://cppa.ca.gov/announcements/2024/20241217.html", "figure": "$26,625,000 ", "value": 26625000, "unit": "USD", "vat": null, "axis": { "obligation": "CCPA business revenue threshold" }, "retrieved_at": "2026-09-26", "quote": "Annual gross revenue amount within the definition of “business” $26,625,000 $25,000,000", "source_class": "primary-government", "text_sha256": "ef596f1adc5d56a0da0da5c00a9bb85a3fa1f2d481aec485ca7bb3912a5b697b" } ], "not_published": [ { "source": "ICO data protection officers", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO personal data breach reporting", "url": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO encryption guidance", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO right to erasure", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO enforcement action", "url": "https://ico.org.uk/action-weve-taken/enforcement/", "retrieved_at": "2026-09-18", "reason": "every candidate on the page was refused" }, { "source": "Data Protection Act 2018", "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS HIPAA Security Rule guidance material", "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html", "retrieved_at": "2026-09-11", "reason": "every candidate on the page was refused" }, { "source": "HHS business associate contracts", "url": "https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS HIPAA enforcement highlights", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "California Attorney General CCPA", "url": "https://oag.ca.gov/privacy/ccpa", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "California Privacy Protection Agency law and regulations", "url": "https://cppa.ca.gov/regulations/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "OAIC notifiable data breaches (Australia)", "url": "https://www.oaic.gov.au/privacy/notifiable-data-breaches", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "EDPB guidelines, recommendations and best practices", "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "FTC privacy and security business guidance", "url": "https://www.ftc.gov/business-guidance/privacy-security", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "PCI SSC about", "url": "https://www.pcisecuritystandards.org/about_us/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "OSHA recordkeeping", "url": "https://www.osha.gov/recordkeeping", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "SEC Division of Examinations", "url": "https://www.sec.gov/about/divisions-offices/division-examinations", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "FCA Handbook SYSC", "url": "https://www.handbook.fca.org.uk/handbook/SYSC/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "FFIEC IT handbook information security booklet", "url": "https://ithandbook.ffiec.gov/it-booklets/information-security/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "the authority per jurisdiction per obligation", "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "label": "EUR-Lex Regulation (EU) 2016/679 (GDPR)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/", "label": "ICO data protection officers", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/", "label": "ICO personal data breach reporting", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/", "label": "ICO encryption guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/", "label": "ICO right to erasure", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/action-weve-taken/enforcement/", "label": "ICO enforcement action", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents", "label": "Data Protection Act 2018", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "label": "HHS HIPAA Breach Notification Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html", "label": "HHS HIPAA Security Rule guidance material", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html", "label": "HHS business associate contracts", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html", "label": "HHS HIPAA enforcement highlights", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://oag.ca.gov/privacy/ccpa", "label": "California Attorney General CCPA", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://cppa.ca.gov/regulations/", "label": "California Privacy Protection Agency law and regulations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://cppa.ca.gov/announcements/2024/20241217.html", "label": "CPPA announcement of the inflation-adjusted CCPA thresholds", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/notifiable-data-breaches", "label": "OAIC notifiable data breaches (Australia)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "label": "EDPB guidelines, recommendations and best practices", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/privacy-security", "label": "FTC privacy and security business guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.pcisecuritystandards.org/about_us/", "label": "PCI SSC about", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.osha.gov/recordkeeping", "label": "OSHA recordkeeping", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.sec.gov/about/divisions-offices/division-examinations", "label": "SEC Division of Examinations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.handbook.fca.org.uk/handbook/SYSC/", "label": "FCA Handbook SYSC", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ithandbook.ffiec.gov/it-booklets/information-security/", "label": "FFIEC IT handbook information security booklet", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "label": "the authority per jurisdiction per obligation", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 3 of the 23 named sources that could be read published a usable figure; 20 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 21 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per obligation, quoted verbatim from the regulator or the statute with its effective date; the comparison across regimes is the figure - which regime gives the shortest breach clock, which sets a DPO threshold at all, which caps a fine at a percentage of turnover, and which of them changed this year. Changed-since the previous read, which is the news when a threshold is inflation-adjusted or a rulemaking package takes effect.", "embed": "

60 to 60 day

2 published figures, Privacy Security Obligation Table, across 3 sources, read 26 September 2026

Source: Attestvio Privacy Security Obligation Table
" }