NIST Privacy Framework, Protect-PPR.PO-P7

Document every personal data breach, its facts, its effects and the remedial action taken, so the Authority can assess compliance.

Keep an up-to-date register of every personal-data breach, its circumstances, its impact and the remedial measures taken, and make it available to the APDPVP.

Take steps to restore the integrity of the information system after unauthorised access or acquisition of personal data, and delay notifying the data subject only where the Commission or a security agency says notification would impede a criminal investigation.

Conduct a good-faith, reasonable, and prompt investigation on becoming aware of a breach of system security involving personal information about a Kansas resident.

On commencement, keep a record of every personal data breach, regardless of whether it meets that threshold, including the facts, its effects and the remedial action taken, and make your threshold analysis available to the Office on request.

Document every personal data breach, its facts, effects and remedial action, so the Agency can verify your compliance.

Document every personal data breach, its facts, its effects, and the remedial steps you took, and expect the Authority to be able to require you to communicate the breach to the affected person if you have not already done so.

Conduct a reasonable and prompt investigation upon becoming aware of a breach of security involving a Nebraska resident's personal information.

If you have cause to believe a confidentiality incident involving personal information you hold has occurred, take reasonable measures to reduce the risk of injury and prevent further incidents of the same nature.

Keep a register of every confidentiality incident, and send a copy to the Commission d’accès à l’information on request.

Keep a record of every personal data breach, its effects, and the remedial action taken, sufficient to demonstrate compliance with the Act's breach notification duties.

Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences and the measures taken, and document every breach, its effects and the remedial action.

Document every breach, including its facts, effects and remedial action, so the Commissioner can assess compliance.

An app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies.

Keep a record of every personal data breach.

Document every breach relating to personal data, including the facts, its effects, and the corrective measures taken, in a form that lets the Commissioner verify your compliance with this duty.

Notify the Unidad Reguladora y de Control de Datos Personales immediately and in detail on becoming aware of the breach, coordinating your response with the national cybersecurity incident response center (CERTuy).

If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.

Keep robust breach detection, investigation and internal reporting procedures in place, and keep a record of all personal data breaches.