P6.6

P6.6

The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy.

Category

Privacy

Subcategory

Privacy Criteria Related to Disclosure and Notification

Points of Focus

Identifies Reporting Requirements [P][C]

The entity has a process for determining whether notification of a privacy breach is required, including the method to be used, the timeline, and the identification of recipients of such notifications.

Provides Notice of Breaches and Incidents[P][C]

The entity has a process for providing notice of breaches and incidents to affected data subjects, regulators, and others to support the achievement of the entity's objectives related to privacy.

Evidence Requests

Area of Focus	Artifact	Description
Third-Party Management	Third-Party Contracts	Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections.