Fiji Data Protection Bill (2020) FjDPB-Controller-Processor-Security-Breach: Controller + Processor Obligations + Security + Breach Notification

Fiji Data Protection Bill 2020 Part IV - Controller and Processor Obligations. CONTROLLER ACCOUNTABILITY: controllers must demonstrate compliance through documented policies + records of processing + data-protection-impact-assessments (DPIAs) for high-risk processing + privacy-by-design + privacy-by-default. PROCESSOR REQUIREMENTS: written contract with controller specifying processing scope + duration + nature + purpose + categories of data + obligations + technical and organisational measures + sub-processor authorisation + cooperation with controller + return + deletion at end of engagement. SECURITY OF PROCESSING: controllers + processors must implement APPROPRIATE TECHNICAL AND ORGANISATIONAL MEASURES considering state-of-the-art + risk + costs including: (a) pseudonymisation + encryption; (b) ability to ensure ongoing confidentiality + integrity + availability + resilience; (c) ability to restore availability + access in timely manner following incident; (d) regular testing + assessing + evaluating effectiveness. PERSONAL DATA BREACH NOTIFICATION (Bill clause + mirrors GDPR Art.33-34 + Singapore PDPA s.26B-D): controllers must notify the PIDPC within 72 HOURS of becoming aware of a personal data breach likely to result in risk to data subjects + provide nature + categories + approximate numbers + likely consequences + measures taken; controllers must also notify DATA SUBJECTS without undue delay if the breach is likely to result in HIGH RISK to data subjects unless effective protection measures applied. BREACH RECORDS: controllers must document all breaches regardless of notification.