Section 172(3)

The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification— without undue delay, and where feasible, not later than 72 hours after becoming aware of it.

← 2 · All articles · 4 →

Source: legislation.gov.uk · retrieved 2026-09-04