Requirement
Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate it to the data subjects without undue delay.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
notifyinformcommunicate
Required element 2 — any one of
data subjectindividualaffected usercustomer
Required element 3 — any one of
breachhigh riskincidentrisk to them is highrisk is highhigh-risk
Supporting terms — specificity signals
without undue delaytemplateplain languageremedial measurescontact point
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GLBA | 314.4(j) | Notify the FTC of notification events affecting 500 or more consumers | breach-notification |
| SOC 2 | CC7.4 | Incident response programme | breach-notification |
| PCI DSS 4.0.1 | 12.10 | Incident response plan for suspected compromise of account data | breach-notification |
| HIPAA | 164.308(a)(6)(ii) | Response and reporting (R) | breach-notification |
| HIPAA | 164.404-410 | Breach notification to individuals, HHS and the media | breach-notification |
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified | breach-notification |
| NDPA 2023 | s.40 | Personal data breaches: notification and breach records | breach-notification |