The DPA contains a general requirement for a personal data breach to be notified by the data controller to the Ombudsman and the relevant data subject(s).  A personal data breach is a wide concept, defined as 'a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed'.

The data controller must notify a breach to the relevant data subject(s) and the Ombudsman without undue delay, and in any case no longer than five days after the data controller should, with the exercise of reasonable diligence, have been aware of the breach.

The same rules apply where a breach occurs at the level of a data processor.  Accordingly, data controllers should contractually require their data processors to notify the data controller of a breach in a timely manner.

The notification must describe the nature of the breach, the consequences of the breach, the measures proposed to be taken by the data controller to address the breach and the measures recommended by the data controller to the relevant data subject(s) to mitigate the possible adverse effects of the breach.