LesothoData Protection Act, 2011, notification of security compromises
Data Protection Act, 2011, s. 23 (notification of security compromises)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Disclosure
- Audit expectation
- none
What it requires
- Notify the Data Protection Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.
- Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.
- Delay notification to the data subject only where the Lesotho Mounted Police Service, the National Security Service, or the Commission determines that notification would impede a criminal investigation.
- Communicate the notification to the data subject in writing, by mail, email, a prominent website posting, publication in the news media, or as the Commission directs, and include enough information to let the data subject take protective measures, including the identity of the unauthorised person if known.
- Publicise the compromise in the manner the Commission specifies, where the Commission has reasonable grounds to believe publicity would protect an affected data subject.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 23 requires a controller, or a third party processing for it, to notify the Commission and the data subject when there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, sets the timing and the form of the notice to the data subject, and lets the Commission direct publicity. It requires no register or record of compromises and names no check of one: a notice is a report sent out, not a log. The section has no scope clause of its own.
- Kind
- None
- As of
What this law does
Section 23(1) requires a data controller, on reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, to notify the Commission and the data subject unless the data subject's identity cannot be established.
Section 23(2) requires that notification to be made as soon as reasonably possible after discovery of the compromise, taking into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise and restore the integrity of the controller's information system.
Section 23(3) requires the controller to delay notification to the data subject where the Lesotho Mounted Police Service, the National Security Service or the Commission determines that notification would impede a criminal investigation.
Section 23(4) requires the notification to the data subject to be in writing, delivered by post, email, a prominent website posting, publication in the news media, or another method the Commission directs, and section 23(5) requires it to contain enough information for the data subject to take protective measures, including the identity of the unauthorised person if known.
Section 23(6) lets the Commission direct a data controller to publicise a compromise where the Commission has reasonable grounds to believe publicity would protect an affected data subject.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .