Common use of Personal Data Breach Notification Clause in Contracts

Personal Data Breach Notification. 8.1 In the event that the Data Processor suffers a Personal Data Breach, the Data Processor shall inform the Data Controller within twenty-four (24) hours upon learning of the same and reasonably cooperate with the Data Controller to mitigate the effects and to minimise any damage resulting therefrom. To the extent reasonably possible, the notification to the Data Controller shall include: (i) a description of the nature of the incident, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) the name and contact details of the Data Processor’s data protection officer or another contact point where more information can be obtained; (iii) a description of the likely consequences of the incident; and (iv) a description of the measures taken or proposed to be taken by the Data Processor to address the incident including, where appropriate, measures to mitigate its possible adverse effects