Rule 7, intimation of personal data breach
In short
Rule 7 creates two obligations, both triggered by the Data Fiduciary becoming aware of a personal data breach.
- Rule 7(1), to each affected Data Principal: to the best of the Data Fiduciary's knowledge, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary.
- Rule 7(2), to the Board: without delay, a description of the breach; and within seventy two hours of becoming aware, or within such longer period as the Board may allow on a request made in writing, the detailed information listed in the rule.
01Rule 7(1), what the Data Principal is told
| Clause | Content |
|---|---|
| 7(1)(a) | A description of the breach, including its nature, extent and the timing of its occurrence |
| 7(1)(b) | The consequences relevant to her that are likely to arise from the breach |
| 7(1)(c) | The measures implemented and being implemented by the Data Fiduciary, if any, to mitigate risk |
| 7(1)(d) | The safety measures she may take to protect her interests |
| 7(1)(e) | Business contact information of a person able to respond on behalf of the Data Fiduciary to her queries |
There is no seventy two hour figure attached to this obligation. It is owed without delay.
02Rule 7(2), what the Board is told
| Clause | Timing | Content |
|---|---|---|
| 7(2)(a) | Without delay | A description of the breach, including its nature, extent, timing and location of occurrence, and the likely impact |
| 7(2)(b) | 72 hours | Updated and detailed information in respect of that description; the broad facts related to the events, circumstances and reasons leading to the breach; measures implemented or proposed, if any, to mitigate risk; any findings regarding the person who caused the breach; remedial measures taken to prevent recurrence; and a report regarding the intimations given to affected Data Principals |
The longer period in clause (b) is available only on a request made in writing, and only if the Board allows it. Nothing in Rule 7 makes an extension automatic.
03The awareness anchor
Both obligations run from becoming aware of the personal data breach. The seventy two hours in clause (b) is measured from that point, not from the initial intimation under clause (a).
Awareness is not the start of the intrusion, and it is not the conclusion of forensics. A Data Fiduciary that learns during the response that unauthorised access began earlier has acquired a fact for the detailed report under clause (b). It has not moved its deadline in either direction.
04Common questions
Does Rule 7 give seventy two hours to notify individuals?
No. Intimation to each affected Data Principal is owed without delay under Rule 7(1). The seventy two hours applies to the detailed information owed to the Board under Rule 7(2)(b).
How can the intimation be delivered?
Through the Data Principal's user account or any mode of communication registered by her with the Data Fiduciary.
Can the seventy two hours be extended?
The Board may allow a longer period on a request made in writing.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.