There is an obligation on the data controller to notify the regulator, the NCGAA and the data subject of any breaches of the measures to protect the data subject's privacy if it is likely to cause damage to the data subject. The notification to the NCGAA and the data subject must be made as soon as possible from the time the data controller becomes aware of the breach but in any event, within 72 hours.

A personal data breach means a breach of security leading to an unlawful or accidental alteration, destruction, loss, unauthorised disclosure of, or access to personal data. This would encompass both, accidental and deliberate breaches such as, theft or loss of IT equipment, inadequate disposal of confidential files that may contain personal data material and using client data for a personal gain. In assessing whether a breach would cause serious damage, the data controller should take into consideration whether the breach would cause the data subject to be impacted negatively in various ways such as emotional distress, or physical or material damage.