s 26E Obligations of data intermediary of public agency
26E. Where an organisation —(a) is a data intermediary processing personal data on behalf of and for the purposes of a public agency; and (b) has reason to believe that a data breach has occurred in relation to that personal data, the organisation must, without undue delay, notify the public agency of the occurrence of the data breach. [40/2020]