Rule 7, intimation of personal data breach

Two audiences, two clocks.

To each affected Data Principal, Rule 7(1): without delay, through her registered contact or user account, describing: - the nature, extent and timing of the breach; - the likely consequences relevant to her; - mitigation measures implemented or being implemented; - safety measures she can take to protect her interests; - contact details of a person able to answer queries.

To the Board, Rule 7(2): two stages. 1. Without delay, on becoming aware: a description of the breach, including its nature, extent, timing and location of occurrence, and the likely impact. 2. Within 72 hours of becoming aware (or a longer period the Board allows on written request), an updated and detailed report covering: - broad facts, and the events, circumstances and reasons leading to the breach; - measures implemented or proposed to mitigate risk; - findings regarding the person who caused the breach; - remedial measures taken to prevent recurrence; - a report on the intimations given to affected Data Principals.

Points to hammer in advice: - No harm or materiality threshold, from Act s.8(6). Every breach as defined in s.2(u) is in scope, including loss of access, so ransomware and serious availability incidents qualify. - The individual notice is "without delay", not 72 hours. Do not let a client build a process that batches user notification behind the regulator report. - The 72-hour clock runs from becoming aware, and the Board's report requires you to have already identified the cause and the person responsible, which is a demanding forensic ask.