What are the penalties for not reporting a data breach?
The failure to disclose a data breach can carry severe legal, financial, and reputational consequences. In 2025, with the enforcement of increasingly rigorous data protection regulations—such as the GDPR, CCPA, and a host of global privacy laws—timely breach notification has evolved from best practice to an unequivocal legal obligation. Enterprises that postpone or neglect to report breaches risk incurring substantial penalties, which may range from thousands to millions of dollars, depending on the breach’s severity and the applicable jurisdiction. For example, the GDPR requires breach disclosures within 72 hours, with non-compliance punishable by fines of up to €20 million or 4% of the organization’s total annual global revenue—whichever is greater. In addition to financial repercussions, failure to comply may expose companies to civil lawsuits, class-action litigation, and a profound loss of consumer trust. Regulatory authorities may also enforce operational limitations, initiate...