Section 26
Notifiable data breaches
of Personal Data Protection Order, 2025
( 1) A data breach is a notifiable data breach if the data breach -
fa} results in, or is likely to result in, significant harm to an affected individual; or
{b) is, or is likely to be, of a significant scale.
(2)
Without limiting subsection (1){a}, a data breach is deemed to result in significant harm to an individual -
fa} if the data breach is in relation to any prescribed personal data or class of personal data relating to the individual; or
{b) in other prescribed circumstances.
(3)
Without limiting subsection (1){b}, a data breach is deemed to be of a significant scale -
fa} if the data breach affects not fewer than the prescribed number of affected individuals; or
(b)
in other prescribed circumstances.
(4)
Notwithstanding subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.