What must an organisation report if personal data leak in Czechia?

The data protection office says a controller must report a breach that may risk people's rights and freedoms, without undue delay, and if possible within 72 hours of learning of it. A breach that is unlikely to create that risk does not have to be reported, but the controller must still record it. If the report is late, the controller must give the reasons.

Continue on Úřad pro ochranu osobních údajů