Pursuant to Article (7) of the Law, each of the controller and the processor, as the case may be, shall notify the Centre with any personal data infringement, within seventy-two (72) hours of such infringement. In the event that such infringement relates to national security protection concerns, the notification shall be immediate. In all events, the Centre shall immediately notify the National Security Authorities with the infringement and provide them, within seventy-two (72) hours from being aware of the infringement, with the following:

• description of the nature of the infringement, the form and the reasons thereof as well as the approximate number of personal data and their records;
• the information of the DPO;
• the potential consequences of the infringement;
• description of the procedures which have been followed and the proposed procedures to be adopted in order to minimize the negative impacts of the infringement;
• evidence of documenting any personal data infringement and the corrective actions which have been taken to solve it; and
• any documents, information or data requested by the Centre.

In all events, the Controller and Processor, as the case may be, shall notify the data subject within three (3) days from the date of notifying the Centre, with the infringement and the adopted procedures related thereto.

The Law defines the National Security Authorities as the Presidency, Ministry of Defence, Ministry of Interior, the General Intelligence Directorate, and the Administrative Control Authority.