Law 21,719 requires reporting of security breaches. Controllers must report to the Agency, with the most expeditious means possible and without undue delay, any security breach that results in the destruction, leakage, loss, or accidental or unlawful alteration of the personal data it processes, or the unauthorized communication of or access to such data, where there is a reasonable risk to the rights and freedoms of impacted data subjects. Controller must also notify affected data subjects to the extent the breach involves sensitive data, minors’ data, or financial type data—using clear language and explaining the consequences and mitigation measures.