Article 44 — Communication of Personal Data Breach

1/ Where a personal data breach has occurred, the controller shall communicate the personal data breach to the data subject within 72 hours after having become aware of it. 2/ The communication to the data subject shall describe in clear language the nature of the personal data breach and set out the information in Article 43 Sub-Article (4) lit. (b)- (d) Of this Proclamation. 3/ The communication of a personal data breach to the data subject shall not be required where: a) The data controller has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the breach, in particular, those that render the data unintelligible to any person who is not authorized to access it, such as encryption; b) The data controller has taken subsequent measures to ensure that the high risk to the rights and freedoms of the data subject referred to in Sub-Article (1) of this Article is no longer likely to materialize; or c) It would involve disproportionate effort and the data controller has made a public communication or similar measure whereby data subject is informed in an equally effective manner. 4/ Where the data controller has not already communicated the personal data breach to the data subject, the Authority may require it to do so.