MonacoLoi sur la Protection des Données Personnelles, notification des violations de données
Loi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to create a risk to the rights and freedoms of the persons concerned, and give the reasons for the delay when you notify later than that.NIST Privacy FrameworkCM.AW-P7
- Communicate a personal data breach to the affected person as soon as possible, in clear language, when it is likely to create a high risk to their rights and freedoms.NIST Privacy FrameworkCM.AW-P7
- As a processor, notify the controller of a personal data breach as soon as you become aware of it.NIST Privacy FrameworkCM.AW-P7
- Describe in the notification to the Authority the nature of the breach, including where possible the categories and approximate number of affected persons and records, a contact point, the likely consequences, and the measures taken or proposed to address it.NIST Privacy FrameworkCM.AW-P7
- Document every personal data breach, its facts, its effects, and the remedial steps you took, and expect the Authority to be able to require you to communicate the breach to the affected person if you have not already done so.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Besides notifying the Authority within 72 hours where feasible, the controller must document every personal data breach, stating the facts, the effects and the remedial steps taken, whether or not the breach was notified. The facts, effects and remedial measures are not log content values, so the content list is empty. Article 32 does not say that the Authority may inspect the breach record or that anyone audits it; the Authority's power to demand documents is in Article 46, outside this row, and is not borrowed. The article states no scope clause.
- Kind
- Explicit
- As of
- Provision
- Article 32(I), last paragraph
- Trigger
- security_incident
What this law does
Article 32.I requires the controller to notify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to create a risk to the rights and freedoms of the persons concerned, and a notification made after that window must be accompanied by the reasons for the delay.
The notification to the Authority must describe the nature of the breach, including where possible the categories and approximate number of affected persons and records, a contact point, the likely consequences, and the measures taken or proposed, and the controller must document every breach, its facts, its effects, and the remedial steps taken. A processor must notify the controller of a breach as soon as it becomes aware of it, with no fixed number of hours stated.
Article 32.II requires the controller to communicate a breach likely to create a high risk to a person's rights and freedoms to that person as soon as possible, in clear language, but states no fixed number of hours for that communication the way it does for the Authority, and excuses it only where the affected data were already rendered unintelligible by measures such as encryption, where later measures mean the risk is no longer likely to materialise, or where individual notice would take disproportionate effort and an equally effective public communication is made instead.
The Authority can still require the controller to communicate the breach to the person if it has not done so. Article 32.I sets the 72 hour period for the notice to the Authority alone; article 32.II gives the notice to the affected person no fixed period, only "dans les meilleurs delais".
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .