← Back to insights
Cross-Border Cases
Practice review: one breach, notification duties in several jurisdictions
A breach involving users in several countries can trigger multiple notification duties with different deadlines.
A typical scenario: a security incident affects users in several countries, and the company must handle multiple breach-notification regimes at once — different deadlines, wording, and recipients.
Deciding under pressure 'whom, when, and what to tell' is highly error-prone or slow.
The lesson: build a cross-jurisdiction breach-response matrix in advance, define each market's deadline and process, and rehearse so response is executable, not improvised.