GuyanaData Protection Act 2023, personal data breach notification
Data Protection Act 2023, ss. 65-66 (notification and communication of a personal data breach)
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Once the Data Protection Act 2023 is commenced, notify the Commissioner of a personal data breach without undue delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of any person, and give reasons for any delay beyond seventy-two hours.
- As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
- Describe in the notification the nature of the breach, the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed, and document every breach with its facts, effects and remedial action.
- Communicate a breach likely to result in a high risk to the rights and freedoms of persons to the data subject, in clear and plain language, without undue delay and where feasible within seventy-two hours of becoming aware of it, unless encryption or later measures remove the risk or direct communication would take disproportionate effort, in which case communicate publicly.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 65(1) requires the data controller, where there is a personal data breach, to notify the Commissioner without undue delay and, where feasible, not later than seventy-two hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of any person. Section 65(2) requires a notification made after seventy-two hours to give reasons for the delay.
Section 65(3) requires a data processor to notify the data controller without undue delay after becoming aware of a breach. Section 65(4) lists what the notification describes, including the nature of the breach, the likely consequences and the measures taken. Section 65(6) requires the controller to document every breach.
Section 66(1) requires the controller to communicate a breach likely to result in a high risk to the rights and freedoms of persons to the data subject without undue delay and, where feasible, not later than seventy-two hours after becoming aware of it. Section 66(3) lifts that duty in three cases, including where encryption made the data unintelligible.
Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on following passage on . No commencement order has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.