BelizeData Protection Act 2021, personal data breach notification
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdfA breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Where feasible, notify the Data Protection Commissioner of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to risk a person's rights and freedoms.
- Where a personal data breach is likely to result in a high risk to a person's rights and freedoms, notify that person without undue delay and, where feasible, not later than 70 hours after becoming aware of it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
A data controller must document every personal data breach, including the facts, its effects and the remedial action taken, so that the Commissioner can assess its compliance with the section. Sections 60 to 62 state no territorial scope.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act 2021, section 61(6)
- Trigger
- security_incident
What this law does
Section 61 requires a data controller, where feasible, to notify the Commissioner of a personal data breach not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to a person's rights and freedoms, with reasons required for any later notification; a data processor must notify the controller without undue delay.
Section 62 requires the controller to notify an affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an exempting condition, such as prior encryption of the data, applies. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .