Under the new regulation, companies must inform the national authority within 24 hours of detecting the breach. If full disclosure is not possible within a day, they should provide an initial set of information within 24 hours, with the rest to follow within three days. The notification should outline which pieces of information are affected and what measures have been or will be applied by the company. In assessing whether to notify subscribers (by applying the test of whether the breach is likely to adversely affect personal data or privacy), companies should pay attention to the type of data compromised, focusing particularly on financial information, location data, internet log files, web browsing histories, e-mail data, and itemised call lists.
To encourage companies to encrypt all customer data, the new regulation will exempt companies from the requirement to notify customers if they have previously employed an approved encryption technique. The latter will be developed with networks security agency Enisa.
