Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification
Law on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later.NIST Privacy FrameworkCM.AW-P7
- As a processor, notify the controller without undue delay after becoming aware of a personal data breach.NIST Privacy FrameworkCM.AW-P7
- Notify the affected person of a personal data breach without delay, in writing and in clear language, wherever the breach is likely to result in a high risk to that person's rights and freedoms, unless the data were rendered unintelligible, the high risk can no longer materialize, or notice would take disproportionate effort and a public notice reaches the person as effectively.NIST Privacy FrameworkCM.AW-P7
- Describe in the notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences and the measures taken or proposed, supplying the information in phases if it cannot all be given at once, and document every breach, its facts, effects and remedial action for the Agency to review.NIST Privacy FrameworkCM.AW-P7NIST Privacy FrameworkPR.PO-P7
- As a competent authority processing personal data for a criminal-law purpose, notify the Agency of a breach without delay and no later than 72 hours after becoming aware of it, and the affected person without delay under the same high-risk test, and pass the breach information to the data controller of another country without undue delay wherever the breached data were transmitted by or to it.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 35(5) requires the controller to document every personal data breach, with its facts, consequences and the remedial action, so that the Agency can check the Article 35 duty; Article 86(6) says the same for a competent authority and Article 86(7) requires that documentation to be made available to the Agency to verify Article 86. The documented items (facts, consequences, remedial action) are not values of the log-contents list. Articles 35(1) to (4), 36 and 87 are notices to the Agency and to the person, not records.
- Kind
- Explicit
- As of
- Provision
- Article 35(5) and Article 86(6) and (7) (a breach is documented, whether or not it is notified)
- Trigger
- security_incident
What this law does
Article 35 requires the data controller to notify the Agency of a personal data breach without undue delay and, if possible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger a person's rights and freedoms, giving the Agency the reasons for the delay if notice comes later than 72 hours.
Article 35(2) requires a processor to notify the controller without undue delay after becoming aware of a breach, and Article 35(3) fixes what the notification to the Agency must contain: the nature of the breach and, where possible, the categories and approximate numbers of people and records concerned, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed, which Article 35(4) lets the controller supply in phases where they cannot all be given at once.
Article 35(5) requires the controller to document every breach, its facts, consequences and remedial action, so the Agency can review compliance.
Article 36 requires the controller to notify the affected person in writing without delay wherever the breach is likely to result in a high risk to their rights and freedoms, describing the breach in clear and plain language and giving the same contact-point, consequences and measures information, unless the data were rendered unintelligible by a measure such as encryption, a later measure has removed the high risk, or notice would take disproportionate effort and a public notice reaches people as effectively; Article 36(4) lets the Agency require the notice anyway where none of those conditions is met.
Articles 86 and 87 restate the same 72-hour Agency notice and high-risk person notice for a competent authority processing personal data for a criminal-law purpose, and Article 86(8) additionally requires the competent authority to pass the breach information on to the data controller of another country without undue delay wherever the breached data were transmitted by or to that controller.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .