Section 28

Where an organisation assesses, in accordance with section 27, that a data breach is a notifiable data breach, the organisation shall notify the Authority as soon as is practicable, but in any case no later than 3 days after the day the organisation makes that assessment.

Subject to subsections (5), (6) and (7), on or after notifying the

Authority under subsection ( 1), the organisation shall also notify each affected individual affected by a notifiable data breach mentioned in section 26(1){a} in any manner that is reasonable in the circumstances.

The notification under subsection (1) or (2) shall contain, to the best of the knowledge and belief of the organisation at the time it notifies the Authority or affected individual, all the information that is prescribed for this purpose.

The notification under subsection (1) shall be made in such form and manner as the Authority may require.

Subsection (2) does not apply to an organisation m relation to an affected individual if the organisation -

(a} on or after assessing that the data breach is a notifiable data breach, takes any action, in accordance with any prescribed requirements, that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual; or

(b} had implemented, prior to the occurrence of the notifiable data breach, any technological measure that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual.

No organisation shall notify any affected individual in accordance with subsection (2) if -

(a} a prescribed law enforcement agency so instructs; or 31

{b) the Authority so directs.

The Authority may, on the written application of an organisation, waive the requirement to notify an affected individual under subsection (2)

subject to any condition that the Authority thinks fit.

An organisation is not, by reason only of notifying the Authority under subsection ( 1) or an affected individual under subsection (2), to be regarded as being in breach of -

{a) any duty or obligation under any written law or rule of law, or any contract, as to secrecy or other restriction on the disclosure of information; or

{b) any rule of professional conduct applicable to the organisation.

Subsections ( 1) and (2) apply concurrently with any obligation of the organisation under any other written law to notify any other person (including any public agency) of the occurrence of a data breach, or to provide any information relating to a data breach.