In the event of a personal data security breach, the controller must notify the Agency within 72 hours. If notification is delayed, the controller must explain the reasons for the delay. The processor must inform the controller without undue delay upon becoming aware of a personal data breach.

The report to the Agency must include at least:

• A description of the nature of the breach, including, if possible, the categories and approximate number of data subjects affected and the categories and approximate number of personal data records involved;
• Contact details of the DPO or another point of contact for further information;
• A description of the likely consequences of the breach;
• A description of the measures taken or proposed by the controller to address the breach, including, where appropriate, measures to mitigate potential adverse effects.

If it is not possible to provide all information at once, the controller may submit information in phases, without unnecessary delay. The controller must document every personal data breach, including the facts relating to the breach, its effects, and the remedial measures taken. Such documentation enables the Agency to exercise its enforcement powers effectively. If there is a high risk to the rights and freedoms of natural persons, the controllers are also obliged to inform the data subjects themselves.

The controller must promptly notify the data subject in writing if a personal data breach is likely to result in a high risk to their rights and freedoms. The notification should be clear and simple, explaining the nature of the breach and the measures taken to mitigate it.

Notification is not required if:

• appropriate technical or organizational safeguards were in place at the time of the breach (e.g., encryption),
• subsequent measures ensure the high risk to the data subject is eliminated, or
• direct notification would require disproportionate effort, in which case a public statement or equivalent measure can be used to inform data subjects effectively.

If the controller fails to notify the data subject, the Agency can require them to do so after assessing the likelihood of high risk, unless one of the exemption conditions applies.