FTC Safeguards Rule Breach Notice: 30-Day Clock Starts at Triage, Not Legal Review

Triage timestamp in practice

Consider a concrete sequence. At 09:14 on Day 0, a support agent takes a customer call reporting unauthorized access to an account. The agent opens a ticket and records the report at 09:22. That eight-minute gap is the whole argument of this section: the discovery event already happened, and the only durable proof of it is the ticket timestamp.

Checkpoint 1 is the triage log. The 09:22 entry — not the date legal review concludes on Day 3 — is the discovery record. Triage is where the organization first learns of the event and first characterizes it; legal review refines the response but is not the trigger. The practical rule: configure the ticketing system so the initial report timestamp is captured automatically at intake and cannot be edited by any subsequent handler. If discovery is recorded only in a case-management note written after legal review, three days are gone and cannot be recovered.

Checkpoint 2 is classification. During the same triage pass, the analyst counts the affected population and determines the event touches 500 or more consumers. That reaches the notification threshold Davis Wright Tremaine describes for covered financial institutions, which converts an internal incident ticket into a reportable notification event. Capture the count, its basis, and the discovery timestamp in the same triage record — the threshold determination is what turns a support ticket into a regulatory obligation.

The checklist below is the minimum triage output. Every row must be complete before the ticket leaves triage; a blank is an escalation trigger, not work in progress.

The purpose of the table is not documentation for its own sake. When the FTC asks when the organization discovered the event, the answer is the 09:22 line, and the ability to produce it is the difference between a defensible filing and an explanation for the delay. Instrument triage so that line is generated as a byproduct of intake rather than reconstructed later.

Worked Example: Run the Numbers

Let's run one concrete example end to end. Scenario: a regional credit union (a covered financial institution under the amended Safeguards Rule) detects anomalous database access during a Tuesday-morning triage shift. The security analyst opens an incident ticket and stamps it at triage on March 3, 2026. Legal review concludes on March 10, and counsel confirms the event affects more than 500 consumers. The question is which date starts the 30-day notification clock that Davis Wright Tremaine summarizes as "as soon as possible, and no later than 30 days after discovery."

Step one: count from the triage timestamp. March 3 plus 30 days means 30 calendar days forward — March has 31 days, so 28 days after March 3 lands on March 31, and the remaining 2 days land on April 2. That is the notification deadline if discovery is the triage stamp. Step two: count from legal sign-off instead. March 10 plus 30 days: 21 days after March 10 lands on March 31, and the remaining 9 days land on April 9. These are illustrations of the counting method, not legal advice on any specific matter.

The winner for this example is the triage timestamp: it produces the earlier, conservative deadline of April 2, and it matches the rule's plain language, which ties the clock to discovery rather than to internal review. The seven-day gap is the exposure. If the institution counted from legal sign-off and filed on, say, April 5, it would be three days late under the triage-based count — a violation even though the team believed it had four days of margin.

The break-even trigger is the lag between detection and triage. In this example, the institution has slack only if the triage stamp occurs on the same day the anomalous access is first observed. Every day of delay between detection and a timestamped triage record consumes deadline margin one-for-one. The check: if your ticketing system cannot produce a timestamped discovery record within 24 hours of an alert, escalate to the compliance officer immediately rather than waiting for the analysis to mature.

One operational takeaway from the arithmetic: the seven-day difference here scales directly with your review pipeline. Cut a day from legal review and you gain nothing if the clock already started at triage; cut a day from alert-to-triage and you gain a day of filing margin. Instrument triage accordingly.

Decision rules for the 30-day clock

Under the amended FTC Safeguards Rule, the 30-day clock for a notification event affecting 500 or more consumers starts at discovery — and discovery, in practice, is a triage timestamp, not a legal opinion. That means the decision rules below should live in your incident response playbook, not in a memo. Each one is an if/then your on-call staff can execute without waiting for counsel.

Rule one: if triage logs the event, then treat that logged timestamp as discovery and start the 30-day clock immediately. The check is simple — can your triage tooling produce a timestamped discovery record within 24 hours of the first human look? If not, escalate to the compliance officer right away, because an untimestamped event is a clock you cannot prove you started.

Rule two: if legal review is requested, then do not pause the clock. Legal review runs in parallel with the notification window, not in front of it. The practical check: your timeline should show legal analysis and FTC notification preparation as concurrent workstreams, with the discovery timestamp fixed at triage and untouched by any downstream review decision.

Rule three: if the event affects 500 or more consumers, then FTC notification is required "as soon as possible, and no later than 30 days after discovery," as Davis Wright Tremaine summarizes the amended rule. The check here is a headcount discipline: your triage record should capture an initial consumer-impact estimate at discovery, then document every revision, so the 500-consumer threshold determination is auditable rather than reconstructed after the fact.

One operational note borrowed from adjacent regimes: independent fostering agencies notifying Ofsted must have a system ensuring notifications are made within 24 hours and that a written record of actions and outcomes is kept, per the Ealing notification guidance. The parallel is instructive — a fixed, short first-record deadline paired with a written audit trail is exactly the instrumentation your triage process needs so the 30-day clock is anchored to evidence, not to memory.

What to do next

Frequently Asked Questions

If a support agent hears about unauthorized access on a call but doesn't log a ticket for a few minutes, which timestamp counts as discovery?

The ticket timestamp recorded at intake — in the example, the 09:22 entry made eight minutes after the 09:14 call — is the discovery record, not the time of the call itself.

Does the notification clock wait until legal review finishes analyzing the incident?

No — legal review on Day 3 refines the response but is not the trigger, because triage is where the organization first learns of and characterizes the event.

How many affected consumers turn an internal incident ticket into a reportable notification event?

When the analyst determines during triage that the event touches 500 or more consumers, it reaches the notification threshold Davis Wright Tremaine describes for covered financial institutions.

What should the ticketing system be configured to do with the initial report timestamp?

It should capture the initial report timestamp automatically at intake and make it impossible for any subsequent handler to edit.

What information should be captured in the triage record beyond the timestamp?

The count of affected consumers and the basis for that count should be captured in the same triage record alongside the discovery timestamp.

What happens if discovery is only documented in a case-management note written after legal review?

Three days are gone and cannot be recovered, since the durable proof of discovery is the triage log rather than a post-review note.

Quick answers