LexLint.ioBeta

Know the law your code answers to.

Law / Barbados

Data Protection Act, 2019, personal data breach notification

Data Protection Act, 2019, ss. 63-64 (personal data breach notification)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
on_request
Who audits it
Regulator

What it requires

  • Notify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later.NIST Privacy FrameworkCM.AW-P7
  • Communicate a personal data breach likely to result in a high risk to the rights and freedoms of individuals to the affected data subject, in clear and plain language, without undue delay and, where feasible, not later than 72 hours after becoming aware of it.NIST Privacy FrameworkCM.AW-P7
  • As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.NIST Privacy FrameworkCM.AW-P7
  • Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned, the contact point for more information, the likely consequences and the measures taken, supplying the information in phases without undue further delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
  • Document every personal data breach, its facts, its effects and the remedial action taken, so the Commissioner can assess compliance.NIST Privacy FrameworkPR.PO-P7

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Section 63(6) requires the controller to document any personal data breach, with its facts, effects and the remedial action taken, in order to facilitate the Commissioner in assessing the controller's compliance with section 63. The documented items are not values of the log-contents list. Section 63(1) to (5) and section 64 are notices to the Commissioner and to the data subject, not records, and the section states no period for keeping the documentation.

Kind
Explicit
As of
Provision
Section 63(6) (a breach is documented, whether or not it is notified)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 63(1) requires a data controller, where there is a personal data breach, to notify it to the Commissioner without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and section 63(2) requires a notification made outside that period to be accompanied by reasons for the delay.

Section 63(3) requires a data processor to notify the data controller without undue delay after becoming aware of a personal data breach.

Section 63(4) fixes what the notification must describe: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data privacy officer or other contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its adverse effects, with information given in phases without undue further delay where it cannot all be supplied at once.

Section 63(6) requires the controller to document every personal data breach, its facts, effects and remedial action, so the Commissioner can assess compliance.

Section 64(1) requires the controller to communicate a breach likely to result in a high risk to the rights and freedoms of individuals to the data subject without undue delay and, where feasible, not later than 72 hours after having become aware of it, in clear and plain language, and section 64(3) excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures have made the high risk no longer likely to materialise, or where it would involve disproportionate effort and a public communication of equal effect is made instead.

Section 100 leaves commencement to a proclamation. The Official Gazette of carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

When LexLint raises it

When your app profile says your app runs an essential service or processes personal data.

Back to the example  ·  Lint your app

Page updated .