Privacy

In fact, notice of a Data Breach may come internally, through data processors, or externally through the Data Processor, a Data Subject, or others who learn of the breach.

Upon learning of a data breach, the Data Controller will endeavor to identify the type of breach that has occurred, first making a summary assessment about the damage that has occurred, and estimating the time required to restore the data, as well as assessing whether in fact the personal data breach may present a risk to the rights and freedoms of individuals.

In the latter case, the Holder must notify the Supervisory Authority of the breach within 72 hours of becoming aware of it and, if appropriate, also proceed with the notification of the affected Data Subjects.

If, on the other hand, the analysis carried out does not reveal any risk to the Interested Parties, the Owner will not be obliged to proceed either with the notification to the Authority or with the communication to the Interested Parties.

However, it will be necessary to prove and document the reasons for non-notification and the absence of risks.

In either case, however, the Data Controller must document any personal data breach, including the circumstances surrounding it, its consequences, and the steps taken to remedy it, in a special register that he or she will be responsible for keeping and keeping up-to-date.