SerbiaLaw on Personal Data Protection, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Commissioner of a breach that may create risk to a person's rights and freedoms without undue delay, and within 72 hours of becoming aware of the breach where that is possible; give reasons for any delay beyond 72 hours.NIST Privacy FrameworkCM.AW-P7
- As a processor, notify the controller without undue delay after becoming aware of a breach.NIST Privacy FrameworkCM.AW-P7
- Notify the affected person of a breach without undue delay, in clear language, whenever the breach may create high risk to their rights and freedoms.NIST Privacy FrameworkCM.AW-P7
- Describe in the Commissioner notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed, and supply the information in phases without undue further delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
- Document every breach, including its facts, effects and remedial action, so the Commissioner can assess compliance.NIST Privacy FrameworkPR.PO-P7
- Skip notifying the affected person only where you have made the data unintelligible, such as by encryption, where subsequent measures have removed the high risk, or where notifying would take disproportionate effort and you have made an equally effective public communication instead; the Commissioner can still order the notice.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 52(6) requires the controller to document every personal data breach, whether or not it is notified, with the facts of the breach, its consequences and the remedial measures taken, and Article 52(7) requires the documentation to let the Commissioner verify compliance with the Article. Articles 52 and 53 also set the 72-hour notice to the Commissioner and the notice to the data subject, which are notification duties. The Articles carry no scope clause of their own, so no territorial hook is read.
- Kind
- Explicit
- As of
- Provision
- Article 52, paras. 6 and 7
- Trigger
- security_incident
What this law does
Article 52 requires a controller to notify the Commissioner of a personal data breach that may create risk to a person's rights and freedoms without undue delay, and within 72 hours of becoming aware of the breach where that is possible, giving reasons for any delay beyond that period. A processor must notify the controller without undue delay after becoming aware of a breach.
The notification to the Commissioner must describe the nature of the breach, give the data protection officer's or another contact point's details, describe the likely consequences and the measures taken or proposed, and article 52 lets the controller supply this information in phases without undue further delay where it cannot all be given at once; the controller must also document every breach, including its facts, effects and remedial action, so the Commissioner can assess compliance.
Article 53 requires the controller to notify the affected person without undue delay, in clear and understandable language, wherever the breach may create high risk to their rights and freedoms, but excuses that notice where encryption or another measure has made the data unintelligible, subsequent measures have removed the high risk, or notifying would take disproportionate effort and a public communication substitutes for it, with the Commissioner able to order the notice anyway.
The act states no fixed number of hours for notifying the affected person; only the notice to the Commissioner carries the 72-hour figure.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .