1. Immediate Notification to Affected Data Principals

Once a Data Fiduciary becomes aware of a personal data breach, it must promptly notify each affected Data Principal. This is a mandatory requirement and is central to ensuring that individuals can take timely protective actions.

1.1 Mode of Communication

• • Notification must be issued without delay.
  • Communication should be through:
    • The Data Principal’s user account, or
    • Any registered mode of communication such as email, SMS, mobile app notification, or other channels maintained with the Data Fiduciary.

1.2 Mandatory Contents of Notification

The communication must be concise, clear, and plain, covering the following:

(a) Description of the Breach

• • Nature of the breach (e.g., unauthorized access, accidental loss, data leak).
  • Extent of data compromised (categories, volume, sensitivity).
  • Timing of occurrence and discovery.

(b) Relevant Consequences

• • Any likely harm that may arise:
    • Identity theft, fraud, financial risk
    • Unauthorized profiling
    • Potential misuse of personal or sensitive information

(c) Mitigation Measures by the Data Fiduciary

• • Immediate containment actions taken.
  • Steps implemented to minimize risk (e.g., blocking accounts, resetting credentials, disabling affected systems).
  • Long-term measures already initiated, if any.

(d) Safety Measures for Data Principals

• • Recommendations to protect themselves such as:
    • Changing passwords
    • Monitoring accounts
    • Enabling additional authentication
    • Reporting suspicious activity

(e) Contact Information

• • Business contact details of a responsible person.
  • This must enable two-way communication where Data Principals can raise queries and seek clarifications.

This ensures that Data Principals are fully informed and empowered to safeguard their personal interests.