Runs an essential service, in Barbados

Data Protection Act, 2019, ss. 63-64 (personal data breach notification) · Read the law's page

• Notify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later.
• Communicate a personal data breach likely to result in a high risk to the rights and freedoms of individuals to the affected data subject, in clear and plain language, without undue delay and, where feasible, not later than 72 hours after becoming aware of it.
• As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned, the contact point for more information, the likely consequences and the measures taken, supplying the information in phases without undue further delay where it cannot all be given at once.
• Document every personal data breach, its facts, its effects and the remedial action taken, so the Commissioner can assess compliance.