According to the New Regulation, a 'personal data security incident' is defined as any breach of security that results in destruction, loss, unlawful alteration, or unauthorized disclosure of, or access to, personal data.

Where a personal data security incident results in the exposure of large volumes of personal data -whether by volume or by the nature of the data- or affects a large number of data subjects, involves Sensitive Personal Data, or gives rise to evident prejudice to the data subject’s fundamental rights or freedoms, the database holder must notify the NDPA no later than 48 hours after becoming aware of the incident.

If the notification is submitted after this period, it must include the reasons for the delay, together with supporting evidence. At a minimum, the personal data security incident notification must include the following information:

• The nature of the personal data security incident, including, where possible, the categories of personal data involved and the approximate number of affected data subjects;
• The name and contact details of the DPO or another contact point from whom additional information may be obtained;
• The potential consequences of the personal data security incident; and
• The measures adopted or proposed by the data controller to address the personal data breach, including, where applicable, measures taken to mitigate its possible adverse effects.

The personal data security incident reporting form may be accessed through the following link: https://reporte.cnsd.gob.pe/home/minjus

It should be noted that this notification obligation applies even if the data controller considers that the incident has already been remedied or internally resolved.

Likewise, when a database holder becomes aware of a personal data security incident that affects the data subject’s other rights, it must inform the affected data subject without undue delay and, in any event, within 48 hours.

Such communication must be made in clear and simple language and include information on the measures adopted to mitigate the effects of the incident. If the communication is made after the 48-hour period, the reasons for the delay must be provided.

Furthermore, where a personal data security incident occurs in and/or through a digital environment, the incident must be reported not only to the NDPA but also to the National Center for Digital Security, for its registration in the National Register of Digital Security Incidents, in accordance with Emergency Decree No. 007-2020, which approves the Digital Trust Framework ('Emergency Decree').

Pursuant to the Emergency Decree, public administration entities, digital service providers in the financial sector, public utilities providers (electricity, water, and gas), healthcare and passenger transportation service providers, internet service providers, other providers of critical activities (defined as economic and/or social activities whose disruption would have serious consequences for public health and safety, the continuity of essential services, or the overall economic and social well-being) and educational service providers must comply with the following obligations: (a) notify the National Center for Digital Security of every digital security incident; and (b) report and cooperate with the NDPA in the event of a digital security incident involving personal data.