The Article 29 Data Protection Working Party stated that ‘Controllers and Processors are encouraged to plan in advance and put in place processes to be able to detect and promptly contain a breach, to assess the risk to individuals, and then to determine whether it is necessary to notify the competent supervisory authority, and to communicate the breach to the individuals concerned when necessary’.
Extract from the Article 29 Working Party ‘Guidelines on personal data breaches and notifications’
