NicaraguaLey No. 787, Ley de Protección de Datos Personales, security incident notice
Ley No. 787, art. 11 (security incident notice to the affected institution)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Publisher's page: http://legislacion.asamblea.gob.ni/normaweb.nsf/9e314815a08d4a6206257265005d21f9/e5d37e9b4827fc06062579ed0076ce1dIn force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Security
- Audit expectation
- none
What it requires
- Where the personal data affected belong to a member of the National Police or the Army of Nicaragua, and the security measures the law requires fail or are not observed, immediately inform the affected institution of the breach.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 11 requires technical and organizational measures that guarantee integrity, confidentiality and security and that allow deviations of private information to be detected, and, when the data are about members of the National Police or the Army and the measures fail or are ignored, requires the controller to inform that institution immediately. A detection capability names no log or record, and the notice goes to the affected institution and not to the data protection authority. The row cites no scope clause, so no territorial hook is listed.
- Kind
- None
- As of
What this law does
Article 11 requires the data controller to adopt the technical and organizational measures necessary to guarantee the integrity, confidentiality, and security of personal data and to detect intentional or unintentional deviations of private information, whatever the source of the risk.
Where the personal data concerned belong to a member of the National Police or the Army of Nicaragua and the required security measures fail or are not observed, article 11 requires the data controller to immediately inform the affected institution, though the Act states no equivalent duty to notify the Direccion de Proteccion de Datos Personales or the general public of a security breach.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .