Following a breach, what is the BEST source to determine the maximum amount of time before customers must be notified that their personal information may have been compromised?

Industry standards provide best practices and guidelines but typically do not mandate legally binding notification timelines.

An organization's information security policy should reflect regulatory requirements, but the policy itself is not the primary source of the legal mandate or specific timelines.

An incident response plan outlines the procedures for notification, but the actual legally required timelines are derived from external regulations.

Industry regulations, such as GDPR, CCPA, or HIPAA, explicitly define the legal requirements and mandatory timelines for notifying affected individuals and supervisory authorities after a personal data breach. Non-compliance can lead to significant legal penalties and reputational damage, making them the definitive source for such requirements.