Breach Notification Framework (R.7)

Rule 7 establishes a structured two-tier breach notification framework: Level 1 - Preliminary Notification: The Data Fiduciary must notify the Data Protection Board without delay upon becoming aware of a personal data breach. This initial notification provides preliminary details about the breach. Level 2 - Detailed Report: Under Rule 7(2)(b), within 72 hours of becoming aware of the breach, the Data Fiduciary must submit a detailed report to the Board including (the Board may permit a longer period where the Data Fiduciary makes a written request): • Facts and circumstances of the breach • Nature and category of personal data affected • Estimated number of Data Principals affected • Possible consequences of the breach • Description of remedial measures taken or proposed • Contact details of the Data Protection Officer or designated contact point This two-tier approach balances the need for rapid notification with the time required to conduct a thorough assessment.

In addition to notifying the Board, the Data Fiduciary must notify affected Data Principals about the breach. The notification must include: • A description of the personal data breach • The possible consequences of the breach • Risk mitigation measures that the Data Principal may undertake • Safety measures taken by the Data Fiduciary in response to the breach • Business contact information for the Data Fiduciary The notification must be provided without delay once the Data Fiduciary has identified the affected Data Principals.

Organisations should establish the following breach response procedure: 1. Detection and Containment: Detect the breach through monitoring systems, contain the breach to prevent further data loss, and preserve evidence. 2. Assessment: Assess the nature and scope of the breach - what data was affected, how many Data Principals, and what are the potential consequences. 3. Level 1 Notification: Notify the Board with preliminary details as soon as the breach is confirmed. 4. Investigation: Conduct a thorough investigation within the 72-hour window to gather details for the Level 2 report. 5. Level 2 Report: Submit the detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board has permitted a longer period on written request. 6. Data Principal Notification: Notify affected individuals with clear information and mitigation guidance. 7. Remediation: Implement measures to prevent recurrence and address the root cause. 8. Documentation: Maintain detailed records of the breach, response actions, and lessons learned.