Peru DPL R.34: Reglamento article 34: notification of a security incident to the Authority within 48 hours

What does R.34 require?

Where a personal data security incident exposes large volumes of data by quantity or type, may affect a large number of people, involves sensitive data, or evidently harms other rights or freedoms of data subjects, the owner of the data bank or the controller notifies the National Authority within 48 hours of becoming aware of it, giving the reasons and evidence for any later notification, even if the incident has been remedied internally; the notification describes the nature of the incident including where possible the types of data and approximate number of data subjects, the name and contact details of the Personal Data Officer or other contact point, the possible consequences, and the measures adopted or proposed to remedy the breach and mitigate its effects; where the incident affects the data subject the owner or controller also informs the data subject; the processor informs the owner or controller immediately of any incident it becomes aware of (36).