diff --git a/procedures/incident-response.md b/procedures/incident-response.md
index 669e712..23ced81 100644
--- a/procedures/incident-response.md
+++ b/procedures/incident-response.md
@@ -26,3 +26,9 @@
 - SOC hotline: +49 69 123 456 (24/7)
 - CISO: direct mobile (see 1Password "emergency contacts")
 - Legal: legal@nexus.local
+
+## Regulatory notification requirements
+
+For incidents involving personal data, the supervisory authority (BfDI) must be notified
+within **72 hours** if the breach is likely to result in a risk to individuals.
+Contact DPO immediately upon any P1 involving customer data.