When is a personal information controller required to notify the Commission about a security breach?
Controllers must promptly notify the Commission and affected data subjects if unauthorized acquisition of sensitive data poses a risk of serious harm.
