AlbaniaLaw No. 124/2024, notification of a personal data breach
Law No. 124/2024, Art. 29 (notification of a personal data breach)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours of becoming aware of the breach, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and give the Commissioner your reasons for any later notification.NIST Privacy FrameworkCM.AW-P7
- As a processor, notify the controller immediately after becoming aware of any personal data breach.NIST Privacy FrameworkCM.AW-P7
- Describe in the notification to the Commissioner the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, supplying anything you cannot give at once as soon as possible afterward.NIST Privacy FrameworkCM.AW-P7
- Document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.NIST Privacy FrameworkPR.PO-P7
- From two years after the law's publication in the Official Gazette, inform the data subject of a personal data breach likely to result in a high risk to their rights and freedoms, unless an exception for encryption, other risk reducing measures, or a disproportionate-effort public notice applies; until then this Article 29(3) duty does not itself bind, though the Commissioner may already order you to notify the data subject case by case under Article 29(7).NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 29(6) requires the controller to document every personal data breach, covering the facts, its effects and the corrective measures taken, so that the Commissioner can verify compliance with the article. Those three items are outside the closed list of log contents. The notification to the Commissioner within 72 hours under Article 29(1) and (4), the processor's notice to the controller under Article 29(2) and the notice to data subjects under Article 29(3) are reports, not records. The Law states no period for keeping the documentation.
- Kind
- Explicit
- As of
- Provision
- Article 29(6) (the controller documents every personal data breach)
- Trigger
- security_incident
What this law does
Article 29(1) requires the controller to notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and to give the Commissioner the reasons for any later notification. Article 29(2) requires a processor to notify the controller immediately after becoming aware of any personal data breach.
Article 29(4) requires the notification to the Commissioner to describe the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, and Article 29(5) lets information that cannot all be given at once follow as soon as possible afterward.
Article 29(6) requires the controller to document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.
Article 29(3) requires the controller to inform the data subject of a breach likely to result in a high risk to their rights and freedoms, subject to exceptions for encryption, other risk reducing measures, or a public notice where individual notice would be disproportionate, but this paragraph does not itself bind until two years after the law's publication in the Official Gazette under Article 101(2).
Article 29(7) already lets the Commissioner order the controller to notify the data subject of a high risk breach case by case, so a request that never reaches the data subject can still draw a Commissioner order before the standalone Article 29(3) duty takes effect.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .