§ 26E — Obligations of data intermediary of public agency

26E. Where an organisation —(a)

is a data intermediary processing personal data on behalf of and for the purposes of a public agency; and

(b)

has reason to believe that a data breach has occurred in relation to that personal data,

the organisation must, without undue delay, notify the public agency of the occurrence of the data breach.

[40/2020]