SurinameDraft Law on the Protection of Privacy and Personal Data, breach notification
Art. 20 Wet Bescherming Privacy en Persoonsgegevens
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay, and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; if you do not notify within 72 hours, state the reasons for the delay.NIST Privacy FrameworkCM.AW-P7
- Include in that notice, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, your data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.NIST Privacy FrameworkCM.AW-P7
- As a processor, inform the controller without unreasonable delay after becoming aware of a breach relating to personal data.NIST Privacy FrameworkCM.AW-P7
- Document every breach relating to personal data, including the facts, its effects, and the corrective measures taken, in a form that lets the Commissioner verify your compliance with this duty.NIST Privacy FrameworkPR.PO-P7
- Notify affected individuals of a breach relating to personal data if the Commissioner requires you to, using the communications and means the Commissioner specifies.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 20(4) makes the controller document every personal data breach, with the facts, its effects and the corrective measures taken, so that the Commissioner can verify compliance with the article. The record is kept for every breach, whether or not it is notified. The facts, effects and measures are not log content values, so the contents are left empty. The article sets no period for keeping the record, so no retention value is recorded. The 72-hour notice to the Commissioner (article 20(1)) and the notice to data subjects the Commissioner may require (20(5)) are notifications and not records. Article 20(6) has the Commissioner keep its own non-public register of the notifications it receives, which is the regulator's record and not the controller's. The text is a draft bill.
- Kind
- Explicit
- As of
- Provision
- Article 20(4)
- Trigger
- security_incident
What this law does
Article 20(1) requires a controller to notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay and, if possible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; where notice is not given within 72 hours, the controller must also state the reasons for the delay.
Article 20(2) requires that notice to describe, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, with article 20(3) allowing the information to be given in phases without unreasonable delay where it cannot all be given at once.
Article 16(j) requires a processor to inform the controller without unreasonable delay after becoming aware of a breach relating to personal data. Article 20(4) requires a controller to document every breach, including its facts, effects, and the corrective measures taken, in a form that lets the Commissioner verify compliance with the article.
Article 20(5) lets the Commissioner, after weighing the breach's nature, likely consequences, and mitigation measures, require the controller to notify affected individuals and specify the communications and means to use; article 20(6) has the Commissioner keep a non-public register of breach notifications it receives. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .