Breach Notification Clock (2D)

Incident Timeline

Simulated time speed 4 h/s

Detection delay (breach → discovery) 6 h

File Notification

Live Status

Elapsed since detection

0h 00m

Notified

0 / 4

Cumulative fine exposure

How it works

A single incident can trigger several independent statutory clocks at once, each starting the moment the organisation becomes aware of the breach — not the moment it happened. This model runs four real regulatory deadlines in parallel:

GDPR Art. 33      72 h  from awareness  (EU controller → supervisory authority)
SEC Item 1.05     96 h  from materiality determination (US public company → EDGAR)
US state laws    720 h  "without unreasonable delay", 30-day statutory backstop
HIPAA §164.408  1440 h  60 calendar days (US covered entity → HHS)

Each ring's bead sweeps 360° as time / deadline → 1. A ring you have not notified by the time its bead completes the lap turns red and starts accruing exposure:

overdue(t)   = max(0, t − deadline)
rate         = maxFine / (2 · deadline)
multiplier   = min(3, 1 + detectionDelay / 72)
exposure(t)  = min(maxFine, rate · overdue(t) · multiplier)

The detection-delay multiplier reflects a real regulatory pattern: slower discovery of a breach is itself treated as an aggravating factor when authorities set the final penalty, on top of any late-notification fine. Filing a notification freezes that jurisdiction's exposure permanently, exactly like submitting the regulator report stops the statutory clock in practice — the legal risk instrument here is time, not the attacker.

This 2D edition renders the same four independent clocks as concentric rings viewed from directly above, rather than as tilted 3D torus rings — the underlying schedule, exposure formula and state machine are identical to the 3D original. Drag to pan the view and scroll/pinch to zoom.

EU — GDPR (72h) US — SEC (96h) US states (720h) US — HIPAA (1440h)

Drag to pan · scroll to zoom