LexLint.ioBeta

Know the law your code answers to.

Law / Kosovo

Law No. 06/L-082 on Protection of Personal Data, personal data breach notification

Law No. 06/L-082 on Protection of Personal Data, arts. 33-34 (personal data breach notification)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Notify the Agency for Information and Privacy of a personal data breach without delay and, where feasible, no later than seventy-two hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.NIST Privacy FrameworkCM.AW-P7
  • Give reasons for the delay if notifying the Agency after that seventy-two-hour period.NIST Privacy FrameworkCM.AW-P7
  • As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.NIST Privacy FrameworkCM.AW-P7
  • Communicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 34(3) exception applies.NIST Privacy FrameworkCM.AW-P7
  • Describe in the Agency notification the nature of the breach, the categories and approximate number of data subjects and records affected where possible, a contact point, the likely consequences, and the measures taken or proposed, supplying information in phases without undue further delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
  • Document every personal data breach, its facts, effects and remedial action, so the Agency can verify your compliance.NIST Privacy FrameworkPR.PO-P7

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Article 33(5) requires the controller to document every personal data breach, whether or not it is notified, recording the facts, the effects and the corrective action, and says the documentation lets the Agency verify compliance with the article. Those three items are not log-content values, so the contents are empty. Articles 33(1) to 33(4) and 34 set the 72-hour notice to the Agency and the communication to data subjects, which are notifications and not records. The cited articles have no territorial reach clause, so the hook is empty.

Kind
Explicit
As of
Provision
Article 33(5) (the controller documents every personal data breach)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 33(1) requires the controller, without delay and where feasible no later than seventy-two hours after becoming aware of a personal data breach, to notify the Agency of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 33(1) also requires a notification made after that seventy-two-hour period to be accompanied by reasons for the delay.

Article 33(2) requires a processor to notify the controller without undue delay after becoming aware of a personal data breach. Article 33(3) fixes what the Agency notification must contain at minimum, including the nature of the breach, the categories and approximate number of data subjects and personal data records concerned where possible, a contact point's name and details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

Article 33(4) lets that information be given in phases without undue further delay where it cannot all be given at once. Article 33(5) requires the controller to document every personal data breach, including its facts, effects and remedial action, so the Agency can verify compliance. Article 34(1) requires the controller to communicate a personal data breach to the data subject without undue delay where the breach is likely to result in a high risk to the rights and freedoms of natural persons.

Article 34(3) excuses that communication where the controller had applied protective measures, such as encryption, that rendered the affected data unintelligible, where the controller has since eliminated the high risk, or where communication would take disproportionate effort and a public communication of equivalent effectiveness is made instead.

Article 34(4) still lets the Agency require the communication, or determine that one of the Article 34(3) conditions applies, where the controller has not itself communicated the breach to the data subject.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .