Jamaica Data Protection Act 2020 JM-DPA2020-Breach-Notification-Sec28-30-Duty-Notify-Commissioner-Affected-Subjects-72-Hours-Severe: Jamaica DPA 2020 Personal Data Breach Notification + Sections 28-30 + Duty to Notify Commissioner + Affected Subjects + 72-Hour Reporting + High Risk + Severe + Mitigation + Documentation

Sections 28-30 of the Jamaica Data Protection Act 2020 establish the Personal Data Breach Notification framework. (1) Section 28 Personal Data Breach Definition: (a) breach of security leading to accidental or unlawful (i) destruction; (ii) loss; (iii) alteration; (iv) unauthorised disclosure; (v) access to personal data; (b) covers all data states - at rest + in transit + in use; (c) covers both technical (cyber) + human (insider + negligence) + physical (theft + loss); (d) covers controller + processor breaches. (2) Section 28(2) Duty to Notify Commissioner: (a) NOTIFICATION REQUIRED to OIC without undue delay + WHERE FEASIBLE within 72 HOURS of becoming aware; (b) if delayed beyond 72 hours - reasons must accompany notification; (c) phased notification allowed if full information not available; (d) ongoing updates as investigation progresses. (3) Section 29 Notification Information Required: (a) nature of the breach (i) categories of affected data subjects + approximate numbers; (ii) categories of personal data records + approximate numbers; (b) DPO contact details; (c) likely consequences of the breach; (d) measures taken or proposed to address the breach + mitigate its possible adverse effects. (4) Section 30 Notification to Affected Data Subjects: (a) WHERE BREACH LIKELY TO RESULT IN HIGH RISK to data subject rights and freedoms; (b) WITHOUT UNDUE DELAY; (c) in clear and plain language; (d) Section 30(2) Information - nature of breach + DPO contact + consequences + measures; (e) Section 30(3) Exemptions - if controller implemented appropriate technical/organisational measures rendering data unintelligible (e.g. encryption); if controller subsequently mitigated risk; if would involve disproportionate effort + public communication instead; (f) Commissioner may require notification if not done. (5) Section 28(3) Processor Obligations: (a) processor must notify controller WITHOUT UNDUE DELAY of breach; (b) controller then has 72-hour OIC SLA; (c) Section 26 contract should specify breach notification mechanism. (6) Documentation Requirement per Section 28(5): (a) ALL BREACHES documented regardless of notification threshold; (b) facts + effects + remedial action; (c) enables OIC compliance verification; (d) supports trend analysis + organisational learning. (7) Risk Assessment per Section 30: (a) likelihood + severity assessment; (b) factors include - type of breach + nature/sensitivity/volume of data + ease of identification + severity of consequences + special characteristics of subjects (children/vulnerable) + special characteristics of controller; (c) ENISA + EDPB methodology + WP29 guidelines; (d) Privacy Risk Score frameworks. (8) Cross-Border Breach Notification: (a) if affected data subjects in multiple jurisdictions - notify each Supervisory Authority; (b) lead Supervisory Authority concept where applicable; (c) Commissioner liaison with foreign DPAs; (d) Caribbean + Commonwealth + EU coordination. (9) Breach Response Lifecycle: (a) detection - SIEM + DLP + EDR + insider threat + user reports; (b) containment - isolation + access revocation + system shutdown + business continuity; (c) assessment - scope + impact + risk classification; (d) notification - OIC + subjects + others; (e) eradication - root cause + fix + patches; (f) recovery - restore + monitor; (g) lessons learned - post-mortem + report + improvement. (10) Penalties for Notification Failures: (a) Section 50 administrative penalties up to JMD 10M; (b) Section 31 unauthorised disclosure - up to JMD 4M + 4 years; (c) Section 52 civil compensation; (d) reputational damage + customer churn; (e) potential class action under Section 52. Coordinates with EU GDPR Articles 33 + 34 + UK DPA 2018 + Convention 108+ Article 7(2) + EDPB/WP29 Guidelines on Personal Data Breach Notification + ENISA Methodology + ISO/IEC 27035 + NIST SP 800-61 + Jamaica Section 26 Processor + Section 22 Privacy Notice + Section 25 ROPA + Section 34 DPIA + Section 35 Security + Jamaica Cyber Incident Response Team (Ja-CIRT) coordination + FSC + BoJ cyber breach reporting. Jamaica DPA 2020 Sections 28-30 applies.