s.8 · Rule 7 · Sch.
Breach intimation
Breach intimation is the duty under Section 8(6) to inform the Data Protection Board and every affected Data Principal of a personal data breach, on the clocks Rule 7 sets.
Rule 7 sets two clocks. On becoming aware of a breach, the Data Fiduciary must intimate each affected Data Principal without delay, in plain language, with the nature and extent of the breach, its likely consequences, the measures taken, what the individual can do, and the contact of a person who can answer questions. At the same time it must intimate the Board.
Within seventy-two hours of becoming aware, or longer only if the Board allows on a written request, a detailed report goes to the Board with the findings, the remedial measures, and confirmation of what affected principals were told.
There is no harm threshold. Every breach, as defined in Section 2, must be intimated.
Questions people ask
- Does the seventy-two hours start at the breach or at discovery?
- At becoming aware of it, under Rule 7(2).
- Do we notify the individuals or the Board first?
- Both, without delay, under Rule 7(1). The detailed report to the Board follows within seventy-two hours.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.