Every notification period that applies to a cybersecurity incident in Puerto Rico and under federal law starts from detection, discovery, or a determination. None starts from the completion of a forensic investigation. Ley Núm. 111-2005 counts its 10 days to DACO from the moment the breach is detected; Ley Núm. 40-2024 counts the 48 hours to PRITS from the moment a contracted vendor discovers the incident; the banking agencies' 36-hour rule runs from the determination that a notification incident occurred; HIPAA treats a breach as discovered on the first day the covered entity knew or, exercising reasonable diligence, would have known of it; and Form 8-K Item 1.05 runs from the materiality determination, which must itself be made without unreasonable delay.
The practical consequence is that a company which defers its notification decisions until the forensic report is final will, in most cases, have exhausted the shortest periods before the report arrives. The statutes anticipate this. They contemplate notices that state what is known and what remains under investigation, and several expressly permit supplemental notices as facts develop; they do not contemplate delay in the interest of certainty.
Two practices follow. First, the incident response plan should assign responsibility for the detection determination to a named function and require that the date and basis be recorded at the time. Second, each later determination, on scope, affected jurisdictions, and materiality, should be logged contemporaneously with its author. That log is the record on which regulators, insurers, and plaintiffs will later assess every notification decision, and it is far easier to keep than to reconstruct.
This Legal Update is part of MZLS's Cybersecurity Awareness Month series; the notification periods themselves are set out in our Legal Update of October 19, 2026.
If you have questions about the matters discussed in this Legal Update, please contact the MZLS lawyers with whom you regularly work.
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas (MZLS). It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.
