Section 68(3)

The duty under subsection (1) does not apply where— the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach, the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or it would involve a disproportionate effort.

← 2 · All articles · 4 →

Source: legislation.gov.uk · retrieved 2026-09-04