Runs an essential service, in Bosnia and Herzegovina

Law on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification) · Read the law's page

• Notify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later.
• As a processor, notify the controller without undue delay after becoming aware of a personal data breach.
• Notify the affected person of a personal data breach without delay, in writing and in clear language, wherever the breach is likely to result in a high risk to that person's rights and freedoms, unless the data were rendered unintelligible, the high risk can no longer materialize, or notice would take disproportionate effort and a public notice reaches the person as effectively.
• Describe in the notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences and the measures taken or proposed, supplying the information in phases if it cannot all be given at once, and document every breach, its facts, effects and remedial action for the Agency to review.
• As a competent authority processing personal data for a criminal-law purpose, notify the Agency of a breach without delay and no later than 72 hours after becoming aware of it, and the affected person without delay under the same high-risk test, and pass the breach information to the data controller of another country without undue delay wherever the breached data were transmitted by or to it.