The breach clocks.
Know them before they start.Tick what applies to your company and see every notification deadline you'd be racing after an incident. The time to learn these is now — mid-breach is the most expensive possible moment for regulatory research.
Is this legal advice?
No — it is an orientation tool showing the headline clocks per regime. Real incidents involve counsel, contract review, and facts that change the analysis. The correct use: know the clocks before an incident so your response plan is built around the shortest one that applies to you.
Which clock wins when several apply?
The shortest one drives your operational tempo. A fintech with EU users and a Singapore license effectively operates on a 1-hour internal escalation standard, because you cannot meet a 1-hour regulator notice with a 24-hour triage process.
Do contractual clocks really override statutory ones?
They add to them. BAAs and enterprise DPAs routinely promise customer notification faster than statute requires — 24–72 hours is common. Your obligations are the union of law and every contract you signed, which is why the contract register belongs in your incident plan.