A data security incident involving research data can trigger several
different notification duties at once — and they run on different clocks, to
different recipients, under different legal authority. A supervisory authority in the
EU may need to hear about it within 72 hours under the GDPR; an institutional IRB may
need to hear about it as an “unanticipated problem” under an entirely separate
human-subjects framework; a controlled-access data repository’s Data Access Committee
may have its own 24-hour clock written into a data use certification agreement; and,
if the exposed data was protected health information, HIPAA’s Breach Notification Rule
sets a third, independent deadline. This guide focuses specifically on the
legal and regulatory notification requirements — who a research
institution is legally obligated to notify, and by when, once a security incident
involving research data has occurred — and how those legal duties relate to, but
remain distinct from, the institutional and sponsor-facing notification steps described
in CASRAI’s Data
Breach Response Plan entry.
Data security incident vs. data breach: why the distinction matters for notification
Not every data security incident is a reportable “breach” in the legal sense, and
getting this triage step right is what determines whether any notification clock starts
running at all. A data security incident is the broader, operational
term — any event that jeopardizes the confidentiality, integrity, or availability
of data, from a misconfigured server to a lost laptop to a phishing-compromised account.
A reportable breach is a narrower legal category defined separately by
each applicable law: GDPR defines a “personal data breach” as a breach of security
leading to accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to, personal data; HIPAA defines a “breach” as an impermissible
use or disclosure of unsecured protected health information that compromises its
security or privacy, subject to specific exceptions. An incident that never involved
personal or protected data at all — a denial-of-service attack against a
publicly available dataset with no identifiable individuals in it, for example —
can be a serious security incident without triggering any of the notification regimes
covered below. The impact-assessment step described in CASRAI’s Data Breach Response
Plan entry — determining what data was actually involved and whether it was
properly de-identified
— is what answers this question before any notification clock can be set.
GDPR: notifying the supervisory authority (Article 33) and data subjects (Article 34)
Where research data includes personal data of individuals in the EU/EEA —
human-subjects data collected under a GDPR-governed protocol, or data about
EU-based research staff or collaborators — the General Data Protection
Regulation imposes two separate notification obligations on the controller once a
personal data breach has occurred:
- Article 33 — notification to the supervisory authority. The
controller must notify the competent supervisory authority “without undue delay and,
where feasible, not later than 72 hours after having become aware of” the breach,
unless the breach is unlikely to result in a risk to the rights and freedoms of natural
persons. If the 72-hour deadline is missed, the notification must be accompanied by
reasons for the delay. The notification itself must describe the nature of the breach,
the approximate categories and numbers of data subjects and records affected, the
likely consequences, and the measures taken or proposed to address it. Controllers must
document every breach — including ones ultimately judged not to require
notification — with the facts, its effects, and remedial action taken, so the
supervisory authority can verify compliance with Article 33 on request. - Article 34 — communication to the data subject. A separate,
higher threshold applies here: the controller must communicate the breach to the
affected individuals directly, in clear and plain language, only when it is likely to
result in a high risk to their rights and freedoms — a stricter bar than
Article 33’s “any risk” trigger for notifying the regulator. This obligation does not
apply if the controller had applied appropriate technical protection (such as
encryption) that renders the data unintelligible to anyone without the decryption key,
if the controller has since taken measures that eliminate the high risk, or if
individual communication would involve disproportionate effort, in which case an
equally effective public communication can substitute for individual notice.
Both duties sit with the controller — for research data, this
is typically the institution running the study, not necessarily the individual
researcher, and processors (a cloud vendor or contract research organization, for
example) are separately obligated under Article 33(2) to notify the controller “without
undue delay” once they become aware of a breach, so the controller’s own 72-hour clock
is not reset by a slow-reporting vendor.
HIPAA: the Breach Notification Rule
Where the exposed data is unsecured protected health information (PHI) held by a
HIPAA covered entity or business associate, the HIPAA Breach Notification Rule (45 CFR
Part 164, Subpart D) applies on a different structure than GDPR — a single
60-day outer deadline rather than a 72-hour one, but with more recipients once a
breach crosses a size threshold:
- Notice to affected individuals is required without unreasonable delay and no later
than 60 calendar days after discovery (45 CFR §164.404). - For breaches affecting 500 or more individuals, notice to the HHS Secretary is
required on that same 60-day clock, contemporaneous with individual notice (45 CFR
§164.408); breaches affecting fewer than 500 individuals are instead logged and
reported to HHS annually. - Breaches affecting more than 500 residents of a single state or jurisdiction also
require notice to prominent media outlets serving that area, again within 60 days (45
CFR §164.406).
CASRAI’s HIPAA
Privacy Rule and Data
Breach Response Plan entries cover this rule and its interaction with de-identification in
more depth; it is summarized here to show how it sits alongside GDPR and state law
rather than replacing them — a single incident involving both EU personal data
and US PHI can trigger both regimes’ notification clocks in parallel, on different
timelines, to different recipients.
US state data breach notification laws
Separately from any federal or EU framework, all 50 US states, the District of
Columbia, and several US territories have their own data breach notification statutes
— a patchwork research institutions must check individually rather than assume a
single federal standard covers them, since no comprehensive US federal breach-
notification law exists for data generally (HIPAA’s rule above is sector-specific to
PHI). California enacted the first such law in 2002 (effective 2003); Alabama was the
last state to adopt one, in 2018. Key ways these laws vary, and why the variation
matters operationally:
- Trigger definition. Most states define a reportable breach around
unauthorized acquisition of unencrypted “personal information” — typically a
person’s name combined with a Social Security number, driver’s license number, or
financial account number — a narrower definition than GDPR’s broad “personal
data,” so an incident exposing only research subject codes or de-identified data may
fall outside every state’s trigger even where it would concern an IRB. - Notification timeline. States increasingly favor a fixed deadline
over open-ended language. As of 2026, California, Colorado, Florida, and Washington set
the strictest fixed deadline at 30 calendar days (California’s fixed 30-day standard,
replacing its former “most expedient time possible” language, took effect January 1,
2026 under SB 446); several other states set 45- or 60-day deadlines; roughly 30 states
still use qualitative “without unreasonable delay” language rather than a fixed
number. - Attorney general / state agency notification. A majority of states
(more than two-thirds) additionally require notice to the state attorney general or an
equivalent state agency once the number of affected residents crosses a threshold
— commonly 500 or 1,000 residents, though some set it lower (Texas: 250).
California requires AG notification within 15 calendar days of notifying affected
individuals for breaches affecting more than 500 California residents, under the same
2026 amendment referenced above.
Because these thresholds and deadlines are revised by individual state legislatures
on an ongoing basis, an institution’s data breach response plan should point to a
maintained state-by-state reference (such as a law firm’s client alert or a
compliance-tracking service) rather than hard-coding specific state deadlines into a
static internal document that will drift out of date.
Institutional and sponsor notification: distinct from legal notification
Every notification duty covered above exists independently of a separate category:
notifications a research institution owes to bodies that are not privacy regulators at
all, but that still have a legitimate, often contractual or ethical, interest in
knowing about the incident. These duties can apply even when no law above is triggered,
and missing one is not a regulatory violation in the GDPR/HIPAA/state-law sense, but it
is frequently a contractual breach or a Federalwide Assurance violation with its own
consequences:
- IRB notification. A breach involving identifiable human-subjects
data can independently require reporting to the Institutional Review Board as an
unanticipated problem involving risks to subjects — a duty that flows from an
institution’s Federalwide Assurance and the IRB’s own written procedures, codified
directly for FDA-regulated research at 21 CFR §56.108(b). This applies regardless
of whether the data also happens to be PHI or GDPR-covered personal data. - Repository / Data Access Committee notification. Funder- and
repository-level data use agreements frequently impose their own notification clocks
that are shorter than any statutory deadline — NIH’s dbGaP Data Use Certification
Agreement, for example, requires notifying the relevant Data Access Committee within 24
hours of identifying a breach of data security, followed by a detailed written report
within a few business days. - Sponsor / funding agency notification. A specific award’s terms,
or a bilateral Data Use
Agreement, can independently require notifying the sponsor. Separately, if the
incident involves credible evidence of fraud or a related federal crime connected to a
federal award, 2 CFR §200.113’s mandatory-disclosure rule applies regardless of
whether any breach-notification statute above is also triggered.
CASRAI’s Data
Breach Response Plan entry covers this institutional/sponsor notification layer in
full depth, including worked examples of how it interacts with the legal notification
duties above — this guide’s focus is the reverse direction: the external legal
notification obligations (GDPR, HIPAA, state law) that a response plan needs to route
to correctly, and how they differ from the research-specific duties. A research data
breach response plan, built on the general incident-management discipline described in
CASRAI’s ISO
27001 for Research Data Security guide, is the operational document that is
supposed to route a single incident to all of the applicable duties above — legal
and institutional — rather than treating them as separate processes discovered
one at a time.
Worked illustration: one incident, multiple clocks
The following is an illustrative composite, not a report of an actual
institution or incident, constructed to show how the obligations above can overlap in
practice. A university hospital runs a multinational clinical trial with sites in
the US and the EU. A misconfigured file-sharing link exposes an extract of trial data
that includes both US participants’ unsecured PHI and EU participants’ pseudonymized
but re-identifiable personal data. The same incident now sits on at least three
independent clocks: a 72-hour clock to the relevant EU supervisory authority under
GDPR Article 33 (assuming the risk threshold is met), a 60-day clock to affected
individuals and HHS under HIPAA’s Breach Notification Rule for the US PHI, and an
immediate obligation to notify the study’s IRB as an unanticipated problem. None of
these clocks defers to another; a response plan that only tracks the longest deadline
(HIPAA’s 60 days) would miss the other two entirely.
Frequently asked questions
Does GDPR apply to a US research institution?
It can. GDPR applies based on whose personal data is processed and, in some cases,
where the processing activity is directed, not simply where the controller is
headquartered — a US institution processing personal data of individuals located
in the EU/EEA in connection with offering them services (including participation in a
study) or monitoring their behavior can fall within GDPR’s territorial scope under
Article 3, independent of where the institution itself is based. Institutions running
multinational studies with EU sites or EU participants should treat GDPR notification
duties as a live question, not something that only applies to EU-headquartered
organizations.
Is there a single US federal law requiring data breach notification for research
data generally?
No. HIPAA’s Breach Notification Rule is sector-specific to protected health
information held by a covered entity or business associate; outside of PHI, breach
notification in the US is governed by the patchwork of state laws described above,
plus any sector-specific rule (such as the Federal Trade Commission’s rules for certain
financial or health-adjacent data) that happens to apply to the specific data
involved.
Does GDPR’s 72-hour clock start when the incident happens, or when it’s
discovered?
When the controller becomes aware of the breach, not when the breach itself
occurred — an incident that took place weeks earlier but was only just detected
starts the 72-hour clock at the point of detection, which is why timely internal
detection and escalation matters as much as the external notification step itself.
If a state attorney general notification threshold isn’t met, is any notification
still required?
Individual notification to affected residents is typically required under a state’s
breach law regardless of headcount — the attorney-general threshold in most
states is an additional notification duty that applies once the affected
population crosses a set size, not a substitute for notifying the individuals
themselves at any size.
Does de-identifying research data eliminate these notification obligations?
For HIPAA specifically, data meeting the Safe Harbor or Expert Determination de-identification
standard is no longer PHI and falls outside the Breach Notification Rule. For GDPR,
the analysis is narrower: properly anonymized data (irreversibly, with no reasonable
means of re-identification) falls outside GDPR entirely, but merely pseudonymized data
remains personal data and remains within scope of Articles 33 and 34. State laws vary
in how they define “personal information” and whether encryption or redaction removes
data from their trigger definitions — the underlying statute’s own definition
should be checked rather than assumed to track HIPAA’s or GDPR’s standard.
Related CASRAI resources
- Data Breach
Response Plan — the operational document that routes a research-data incident
to both the legal notification duties on this page and the institutional/sponsor
notification duties described there in depth - ISO 27001
for Research Data Security — the general information security management
system standard underpinning incident detection and response, ahead of any notification
decision - GDPR
(General Data Protection Regulation) - HIPAA Privacy
Rule - De-identification
— how removing identifiers can take data outside GDPR’s and HIPAA’s notification
scope - Data Use Agreement
(DUA) — frequently the source of a repository- or sponsor-specific
notification clock separate from any statute - Research Data Management — cluster
hub
References
- Regulation (EU) 2016/679 (GDPR), Articles 33-34 — notification of a personal
data breach to the supervisory authority and communication to the data subject - 45 CFR Part 164, Subpart D — HIPAA Breach Notification Rule (§164.404,
§164.406, §164.408) - State data breach notification statutes (all 50 states, DC, and several US
territories) — California SB 446 (effective January 1, 2026) - 21 CFR §56.108(b) — IRB written procedures for prompt reporting of
unanticipated problems - 2 CFR §200.113 — Mandatory disclosures (Uniform Guidance)
- NIH Data Use Certification Agreement (dbGaP) — Data Access Committee
breach/incident notification terms
