Section 67(1)

If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner— without undue delay, and where feasible, not later than 72 hours after becoming aware of it.

← 67 · All articles · 2 →

Source: legislation.gov.uk · retrieved 2026-09-04