Requirement
The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy.
Points of Focus
Identifies Reporting Requirements [P][C]
Requirement: The entity has a process for determining whether notification of a privacy breach is required, including the method to be used, the timeline, and the identification of recipients of such notifications.
Provides Notice of Breaches and Incidents [P][C]
Requirement: The entity has a process for providing notice of breaches and incidents to affected data subjects, regulators, and others to support the achievement of the entity’s objectives related to privacy.
Explanation
The organization must notify affected individuals, regulators, and other stakeholders when a privacy breach occurs. Auditors want a documented process that determines when notification is legally required, who must be told, how, and within what timeframe, plus evidence that any actual breaches were reported accordingly.
