Part 3: Law enforcement processing Chapter 4: Controller and processor Sections 67 and 68: Obligations relating to personal data breaches
A personal data breach could lead to a loss of control over data, limitation of rights, reputational damage and other social or economic disadvantages. Therefore, in the event of a data breach whereby there is a risk to the rights and freedoms of the individual, the controller is obliged to inform the Commissioner without undue delay, and where feasible, within 72 hours of becoming aware of it and give details as to how they are mitigating that risk.
	When there is a high risk to the rights and freedoms of an individual as a result of a data breach the data subject(s) should also be notified of the data breach in good time so they may take the necessary precautions to protect themselves. The communication should be made as soon as possible relative to the risk, for example if there is an immediate risk of damage a quick response to data subjects would be advisable (this can be a mass communication if applicable). Given the nature of the data being processed, section 68 enables controllers to restrict the data subject’s right by withholding notice of a data breach in certain circumstances where notifying a data subject would reveal the existence of the data to the detriment of an ongoing criminal investigation etc.