Regulation 5A Personal data breachF1

United Kingdom

(1)

In this regulation and in regulations 5B and 5C, “service provider” has the meaning given in regulation 5(1).

(2)

If a personal data breach occurs, the service provider shall, without undue delay F2and, where feasible, not later than 72 hours after having become aware of it, notify that breach to the Information F3Commission.

(3)

Subject to paragraph (6), if a personal data breach is likely to adversely affect the personal data or privacy of a subscriber or user, the service provider shall also, without undue delay, notify that breach to the subscriber or user concerned.

(F43A)

Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay.

(4)

The notification referred to in paragraph (2) shall contain at least a description of—

(a)

the nature of the breach;

(b)

the consequences of the breach; and

(c)

the measures taken or proposed to be taken by the provider to address the breach.

(5)

The notification referred to the paragraph (3) shall contain at least—

(a)

a description of the nature of the breach;

(b)

information about contact points within the service provider’s organisation from which more information may be obtained; and

(c)

recommendations of measures to allow the subscriber to mitigate the possible adverse impacts of the breach.

(6)

The notification referred to in paragraph (3) is not required if the service provider has demonstrated, to the satisfaction of the Information F5Commission that—

(a)

it has implemented appropriate technological protection measures which render the data unintelligible to any person who is not authorised to access it, and

(b)

that those measures were applied to the data concerned in that breach.

(7)

If the service provider has not notified the subscriber or user in compliance with paragraph (3), the Information Commission may, having considered the likely adverse effects of the breach, require it to do so.

(8)

Service providers shall maintain an inventory of personal data breaches comprising —

(a)

the facts surrounding the breach,

(b)

the effects of that breach, and

(c)

remedial action taken

which shall be sufficient to enable the Information Commission to verify compliance with the provisions of this regulation. The inventory shall only include information necessary for this purpose.

F6(9)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1: Regs. 5A-5C inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 5
F2: Words in reg. 5A(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(1)(a), 142(1); S.I. 2025/904, reg. 2(p)
F3: Word in reg. 5A(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(a); S.I. 2026/1015, reg. 2(c)
F4: Reg. 5A(3A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(1)(b), 142(1); S.I. 2025/904, reg. 2(p)
F5: Word in reg. 5A(6)-(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(a); S.I. 2026/1015, reg. 2(c)
F6: Reg. 5A(9) omitted (14.10.2024) by virtue of Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 11(5), 32(2); S.I. 2024/1021, reg. 2(k)