A legal requirement that organizations notify government authorities and affected persons of a data breach, often within a limited period of time that begins when the breach or cybersecurity incident was discovered.