TEFCA Security Incident Notice to Affected Individuals. Each Signatory that is an IAS Provider must notify each Individual whose TI has been or is reasonably believed to have been affected by a TEFCA Security Incident involving the IAS Provider. Such notification must be made without unreasonable delay and in no case later than sixty (60) days following Discovery of the TEFCA Security Incident. The notification required under this section must be written in plain language and shall include, to the extent possible:
TEFCA Security Incident Notice to Affected Individuals. If You reasonably believe that an Individual has been affected by a TEFCA Security Incident or the Breach of Unencrypted Individually Identifiable Information maintained by You as an IAS Provider, You must provide such Individual with notification without unreasonable delay and in no case later than sixty (60) days following Discovery of the TEFCA Security Incident or Breach of Unencrypted Individually Identifiable Information. The notification required under this section must be written in plain language and shall include, to the extent possible, the information set forth in the applicable SOP(s). To the extent You are already required by Applicable Law to notify an Individual of an incident that would also be a TEFCA Security Incident or Breach of Unencrypted Individually Identifiable Information, this section does not require duplicative notification to that Individual.
