Rule 7: Intimation of personal data breach

When a Data Fiduciary (the entity determining the purpose and means of processing data) discovers a personal data breach, it must notify each affected Data Principal (the individual to whom the data relates) without delay. This notice must be clear, concise, and sent through the individual's user account or registered communication method. The notice must describe the breach, its timing, the likely consequences for the individual, what the Data Fiduciary is doing to mitigate the risk, steps the individual can take to protect themselves, and business contact information for any questions. The Data Fiduciary must also notify the Board (the regulatory authority) about the breach. An initial report describing the breach, its location, and its likely impact must be sent to the Board without delay. Within seventy-two hours of discovering the breach, the Data Fiduciary must send the Board a more detailed update. This detailed update must include the facts and reasons behind the breach, mitigation steps, any findings about who caused it, remedial measures taken to prevent it from happening again, and a report showing that the affected Data Principals were notified. The Board may allow more time for this detailed seventy-two-hour report if the Data Fiduciary submits a written request.

Key points

• A Data Fiduciary must notify affected Data Principals about a personal data breach without delay through their user account or registered contact method. [(1)]
• The notice to the Data Principal must include details of the breach, likely consequences, mitigation measures, and contact information. [(1)(a)-(e)]
• The Data Fiduciary must also notify the Board about the breach without delay, providing its nature, extent, timing, location, and likely impact. [(2)(a)]
• Within seventy-two hours of becoming aware of the breach, the Data Fiduciary must provide the Board with detailed information, including causes, remedial measures, and a report on user notifications. [(2)(b)]
• The Board may extend the seventy-two-hour deadline if the Data Fiduciary makes a written request. [(2)(b)]

Common misreadings

• People might think the seventy-two-hour deadline applies to notifying the Data Principal, but the rule requires notifying the Data Principal without delay, while the seventy-two-hour limit applies to the detailed report sent to the Board.
• People might assume the Data Fiduciary only needs to report a breach to the Board, but the rule explicitly requires notifying both the Board and each affected Data Principal.