Section 68(6)

Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may— require the controller to notify the data subject of the breach, or decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.

← 5 · All articles · 7 →

Source: legislation.gov.uk · retrieved 2026-09-04