Communication of a personal data breach to the data subject
Art. 34
-
Last updated
Mandatory
Catalog reference
When a breach is likely to result in a high risk to people's rights and freedoms, tell the affected individuals directly, in clear and plain language, without undue delay — unless an Art. 34(3) exception applies (e.g. the data was encrypted, or you've since mitigated the high risk).
Narrative — how we satisfy this requirement
The Incident Coordinator has a template for telling affected customers, and the criteria for informing individual data subjects are not yet settled.