නිල පරිවර්තනයවෙනස් නොකළ පාඨය, Department of Government Printing වෙතින්
(1)
In the event of a personal data breach, a controller shall notify the Authority, regarding such personal data breach in such form, manner and within such period of time as may be determined by rules made under this Act.
(2)
The Authority shall provide for–
(a)
the circumstances where the Authority shall be notified of such data breach;
(b)
the circumstances where the affected data subject shall be notified; and
(c)
the form, and manner of making such notification, and information which shall be provided in such notification relating to the data breach, by way of rules made under this Act.