Part 4: Intelligence services processing Chapter 4: Controller and processor Section 108: Communication of personal data breach
A personal data breach could cause serious harm to data subjects. Therefore, in the event of a data breach which seriously interferes with the rights and freedoms of a data subject or data subjects, this section requires the controller to inform the Commissioner without undue delay. If the report is not made within 72 hours, when it is subsequently provided it must be accompanied by an explanation of the reasons for the delay.
	The duty on a controller is disapplied (subsection (6)) where the personal data breach also constitutes a relevant error under section 231 of the Investigatory powers Act 2016. This is designed to avoid the double reporting of breaches. A relevant error under the Investigatory Powers Act means an error made by a public authority in complying with any requirement over which the Investigatory Powers Commissioner has oversight.
	If a processor becomes aware of a personal data breach, they must notify the controller.