white_paper_on_data_protection_in_india_171127_final_v2

There is a need to put in place a notification time line that keeps in mind all the abovementioned
factors.
(iv) Notification Requirements
Once a personal data breach is established the organisation must notify the competent
authority. In US, the HIPAA demands notification of breach to the affected individuals, and in
certain circumstances, to the media. A media notification is required only if a breach affects
more than 500 residents of a state or jurisdiction. Reporting to media might put significant
burdens on small companies. This option should be carefully weighed. Depending upon the
nature of the breach, magnitude of the breach and to whom the notification is addressed, the
format of the notification has to be adapted.
(v)
Individual Notification
As a best practice, a personal data breach notification should mention; the type of personal
data breach, the estimated date of the breach (could be in the form of a range), general
description of the security incident in language that is comprehensible for an individual with
average technical and legal knowledge. The notification must also inform the individual of his
or her rights with respect to the breach and the contact information of the person or office in
charge of addressing related grievances. The notification could be done by way of postal mail
or electronic mail, as long as the notification is communicated to the affected individual in the
stipulated time.
A standard format for notification could be drafted for administrative ease. But the content
should reflect type of personal data breach, , the estimated date of the breach (could be in the
form of a range), general description of the security incident, the estimated number of
individuals affected by the breach, the steps being taken to minimise the impact of the breach
and future resolution.
2.12 Provisional Views
1. The law may require that individuals be notified of data breaches where there is a
liklelihood that they will suffer privacy harms as a result of data breaches.
2. The law may also require that the data protection authority or any authority be notified
immediately on detention of data breaches.
3. Fixing too short a time period for individual notifications may be too onerous on smaller
organisations and entities. This may prove to be counter productive as well as an
organisation may not have the necessary information about the breach and its likely
consequences.
165