EswatiniData Protection Act, 2022, notification of security compromises
Data Protection Act, 2022, s. 17 (notification of security compromises)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Disclosure
- Audit expectation
- none
What it requires
- Notify the Eswatini Communications Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.
- Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.
- Delay notification to the data subject only where the Police or the Commission determines that notification would impede a criminal investigation.
- Communicate the notification to the data subject in writing, by mail, email, a prominent website posting, publication in the news media, or as the Commission directs, and include enough information to let the data subject take protective measures, including the identity of the unauthorised person if known.
- Publicise the compromise in the manner the Commission specifies, where the Commission has reasonable grounds to believe publicity would protect an affected data subject.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 17 requires a controller, or a third party processing under its authority, to notify the Commission and the data subject as soon as reasonably possible after discovering that an unauthorised person accessed or acquired personal information. It is a duty to notify and does not require the controller to document the compromise or keep a register of compromises. The Commission may direct publicity under section 17(6), which is not a record either. The section carries no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 17(1) requires a data controller, on reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, to notify the Commission and the data subject unless the data subject's identity cannot be established.
Section 17(2) requires that notification to be made as soon as reasonably possible after discovery of the compromise, taking into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise and restore the integrity of the controller's information system.
Section 17(3) requires the controller to delay notification to the data subject where the Police or the Commission determines that notification would impede a criminal investigation.
Section 17(4) requires the notification to the data subject to be in writing, delivered by post, email, a prominent website posting, publication in the news media, or another method the Commission directs, and section 17(5) requires it to contain enough information for the data subject to take protective measures, including the identity of the unauthorised person if known.
Section 17(6) lets the Commission direct a data controller to publicise a compromise where the Commission has reasonable grounds to believe publicity would protect an affected data subject.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .