SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notification
Law No. 12 of 2024, art. 8 (personal data breach notification)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator, Produced on request
What it requires
- Notify the Authority immediately on becoming aware of the breach, and expect the Authority to immediately notify the competent authorities where the breach concerns national security matters.
- Notify the Authority within 72 hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's contact details, the breach's likely effects, the measures taken or proposed to address it, and documentation of the breach and the corrective action taken.
- Tell the affected data subject what measures have been taken within three working days of the date you notified the Authority of the breach.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 8(b)(5) has the controller or processor give the Authority, within 72 hours of learning of a breach, documentation of the breach and of the corrective steps taken, and Article 8(b)(6) adds any further document the Authority requests, so a breach must be documented and the document goes to the Authority. The article does not say that the controller keeps a register of every breach, and it names no retention period. Immediate notice to the Authority and notice to the data subject within three working days are notifications, not records. The article contains no territorial scope clause, and the breach description it lists (nature, causes, number of records, persons and categories, effects, measures) names none of the log-content values.
- Kind
- Implicit
- As of
- Provision
- Article 8(b)(5) and (6) (documentation of the breach and the corrective measures given to the Authority within 72 hours, and any further document the Authority requests)
- Trigger
- security_incident
What this law does
Article 8 requires a controller or processor, on becoming aware of a breach of the personal data in its possession, to notify the Authority immediately, and where the breach concerns national security matters, the Authority must immediately notify the competent authorities of the incident.
Article 8(b) requires the controller or processor to provide the Authority, within seventy two hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's details, the breach's likely effects, the measures taken or proposed to address it, documentation of the breach and the corrective steps taken, and any further document, information or data the Authority requests.
Article 8(c) requires the controller and processor to tell the data subject, within three working days of the date the Authority was notified, what measures have been taken.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .