Personal Data Protection Order, 2025 · s 26

Suggest a correction

Tell us what is wrong in this text. We check every suggestion against the official version before we change anything.

What is wrong?Wrong or mistyped wordsWrong structure or numberingWrong title or detailsText that appears twice

What should change, and whyUp to 2,000 characters.The text as it should read (optional)Edit the text above. Up to 20,000 characters.Where you checked it (optional)A link to the official version, if you have one.

The text as we hold it

Open the official text

s 26Notifiable data breaches

( 1) A data breach is a notifiable data breach if the data breach -

fa} results in, or is likely to result in, significant harm to an affected individual; or

{b) is, or is likely to be, of a significant scale.

(2)

Without limiting subsection (1){a}, a data breach is deemed to result in significant harm to an individual -

fa} if the data breach is in relation to any prescribed personal data or class of personal data relating to the individual; or

{b) in other prescribed circumstances.

(3)

Without limiting subsection (1){b}, a data breach is deemed to be of a significant scale -

fa} if the data breach affects not fewer than the prescribed number of affected individuals; or

(b)

in other prescribed circumstances.

(4)

Notwithstanding subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.