white_paper_on_data_protection_in_india_171127_final_v2

eputation, and loss of confidentiality of personal data protected by professional secrecy. 731 It
can also include any other significant economic or social disadvantage to those individuals.
In general, the more sensitive the information involved, the more consequences there may be
for the data subject. It is important to take note of this relationship between the degree of harm
and the sensitivity of the data. Breach of sensitive personal data could have an immediate
impact on the individual, which may lead to reputational or monetary damage.
Where there is a likely high risk of these adverse effects occurring, the EU GDPR requires the
controller to communicate the breach to the affected individuals as soon as is reasonably
feasible. 732 There needs to be an open line of communication between the organisation and its
supervisory authority for the purpose of consultation with respect to the risk associated with
the category of personal data the organisation is handling and the security safeguards,
technical and policy, it has in place to tackle a breach associated with that category of
personal data. The supervisory authority may advise the organisation based on the degree of
harm for the individual, if and when the individual needs to be notified.
(iii) Breach Detection and Notification Duration
The EU GDPR requires that, in the case of a breach, the controller shall notify the breach
without undue delay and, where feasible, not later than 72 hours after having become aware
of it. 733 There has been a great debate around whether the stipulated time frame for
notification is too short and what does it mean to become ―aware‖ of a personal data breach.
Becoming aware of a breach implies the detection of a security incident that has
consequences for personal data of individuals by the organisation. The process of breach
detection is very complex in nature, especially if the organisation has many allied business
entities and the engages third party processors.
It is important to specify where this period of becoming aware of the breach begins. Is it
when the allied business entities or third parties discover the breach or when the same is
notified to the organisation acting as the data controller? It could take months, or even years
to find and assess if the breach is in relation to personal data of an individual. The primary
issue in relation to detection of breach is the large quantity of data that an organization has to
comb through to find anomalies.
731 Article 29 Data Protection Working Party, ‗Guidelines on Personal data breach notification under Regulation
2016/679‘, European Commission (3 October 2017), available at:
http://ec.europa.eu/newsroom/document.cfm?doc_id=47741, (last accessed 10 November 2017).
732 Article 29 Data Protection Working Party, ‗Guidelines on Personal data breach notification under Regulation
2016/679‘, European Commission (3 October 2017), available at:
http://ec.europa.eu/newsroom/document.cfm?doc_id=47741, (last accessed 10 November 2017).
733 Article 33(1), EU GDPR.
163