Currently, notification incidents are regulated by Emergency Decree 007-2020, which approves the Digital Trust Framework, with the intent to strengthen cybersecurity ('Emergency Decree'). A Digital Security Incident is defined under the Emergency Decree as an 'event or series of events that may compromise the trust, economic prosperity, protection of individuals and their personal data, the information, among other assets of the organization, through digital technologies.'

According to the Emergency Decree public administration entities, digital service providers in the financial sector, utilities (electricity, water and gas), healthcare and passenger transportation, internet service providers, and other providers of critical activities (economic and/or social activity whose interruption has serious consequences on the health and safety of citizens, on the effective functioning of essential services that maintain the economy, society and government, or affects the economic and social prosperity in general) as well as educational services must comply with the following: (a) notifying the National Centre for Digital Security (National Centre) about every digital security incident; and, (b) reporting and collaborating with the NDPA in case of a digital security incident that involves personal data. Notwithstanding the foregoing, once the New Regulation enters into force, a mandatory obligation regarding notification incidents will be in place.

According to the New Regulation, a security incident consists of any breach of security resulting in the destruction, loss, unlawful alteration of personal data or unauthorized communication or exposure to such data.

In the event that a personal data security incident results in the exposure of large volumes of personal data, in quantity or type of data, or that may affect a large number of persons or when it involves sensitive data or when there is an evident prejudice to other rights or freedoms of the holder of the personal data, the holder of the database must notify the NDPA at the latest within 48 hours after becoming aware of it or becoming aware of it. If the notification is made after 48 hours, it must include the reasons and evidentiary support for the delay.

The personal data security incident notification should identify and describe at a minimum the following: 

• The nature of the personal data security incident, including, where possible, the types of data and the approximate number of data subjects affected
• The name and contact details of the Personal Data Officer or other points of contact where further information can be obtained
• The possible consequences of the personal data security incident, and
• The measures taken or proposed by the data controller to remedy the personal data security breach, including, if applicable, the measures taken to mitigate the possible negative effects.

It should be noted that this obligation remains even if the data controller considers that the incident has been remedied or resolved internally.

Likewise, the holder of the personal database who notices a personal data security incident that affects the holder of the same in other of his rights, must communicate it within 48 hours without undue delay, in simple and clear language for its understanding, as well as the measures adopted to mitigate its effects. If such communication takes longer than 48 hours, it must be accompanied by an indication of the reasons for such delay.

Furthermore, in the event that the Personal Data security incident takes place in and/or through the digital environment, the notification is made, in addition to the NDPA, to the National Center for its incorporation into the National Register of Digital Security Incidents in accordance with the provisions of the Emergency Decree.

Pursuant to Emergency Decree 007-2020, which approves the Digital Trust Framework, with the intent to strengthen cybersecurity ("Emergency Decree"), public administration entities, digital service providers in the financial sector, utilities (electricity, water and gas), healthcare and passenger transportation, internet service providers, and other providers of critical activities (economic and/or social activity whose interruption has serious consequences on the health and safety of citizens, on the effective functioning of essential services that maintain the economy, society and government, or affects the economic and social prosperity in general) as well as educational services must comply with the following: (a) notifying the National Centre for Digital Security ('National Centre') about every digital security incident; and, (b) reporting and collaborating with the NDPA in case of a digital security incident that involves Personal Data.