Breach Reporting Clock: Who to Notify and by When

A breach starts several clocks at once. GDPR gives you 72 hours from awareness, NIS2 wants an early warning within 24, DORA counts from the moment you classify the incident as major, the SEC from your materiality decision. Get one of them wrong and the report is late before anyone has written a word.

This bundle turns your agent into the incident's reporting desk. It asks the questions each law asks, lets the Moltline RegClock server apply the legal text, and keeps one table current until the last report is filed.

A real run

Ransomware at a German B2B SaaS provider, customer contact data copied, awareness on 10 Nov 2026 at 09:30 CET. RegClock classified it as a GDPR personal data breach and a NIS2 significant incident (Art. 23(3)(a)), then returned:

• NIS2 early warning: due 11 Nov 09:30 CET, Art. 23(4)(a), 13.5 hours left at 20:00.
• GDPR notification to the supervisory authority: due 13 Nov 09:30 CET, Art. 33(1).
• NIS2 incident notification: due 13 Nov 09:30 CET, Art. 23(4)(b).
• NIS2 final report: one month after the notification is sent (shown as 13 Dec until then), Art. 23(4)(d).
• GDPR communication to data subjects: no fixed time limit, without undue delay when the risk is high, Art. 34(1).

The first screenshot is that run.

What it does

• breach-triage: screens seven laws, tests the facts against each law's criteria (RegClock's own questions, with the article), computes every deadline and returns one Reporting Clock.
• deadline-watch: status at every check-in, escalation when a report is due within six hours or overdue, shift hand-overs, and new clocks when a report is sent or a fix ships.
• notification-drafts: each report built from the law's required-content list, facts only, unknowns marked TO CONFIRM, ready for counsel.
• incident-postmortem: a blameless review with a reporting record (due, sent, on time), five whys and action items with owners.

Laws covered

EU GDPR (Art. 33 and 34), UK GDPR, NIS2 (Art. 23), DORA major ICT-related incidents, the Cyber Resilience Act (Art. 14, applying from 11 Sep 2026), HIPAA breach notification and SEC Form 8-K Item 1.05. Rules verified by RegClock on 6 Sep 2026.

How the deadlines are computed

The skills call the Moltline RegClock MCP server at https://mcp.moltlinestudio.com/regclock. The six tools they use are free, with no account and no key. A Python script is included for agents that cannot add an MCP server, and a full rules reference for when there is no network. A Moltline All-Access licence adds a merged timeline across laws, a draft-report checker and calendar export. You don't need any of that to use this bundle.

Limits

• Arithmetic on the legal text, not legal advice. Every output says so and goes to counsel.
• Seven laws. National and US state rules are listed as open questions, not computed.
• It never contacts a regulator, customer or journalist. It prepares, people send.
• Due times are only as good as the awareness time you give it, so triage asks for detection and awareness separately.

Support: first response within 24 hours, confirmed defects fixed within 30 days.