1The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. 2The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. 3Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. 4For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication.
* This title is an unofficial description.
Why Recital 86 Matters for GDPR Compliance?
Recital 86 plays an important role in GDPR compliance by emphasizing the obligation of controllers to inform data subjects about personal data breaches when there is a high risk to their rights and freedoms. It ensures that individuals are made aware of potential risks so they can take necessary precautions, such as protecting their identity or financial information. This recital highlights the need for clear, timely, and transparent communication with affected individuals, including details about the nature of the breach and recommended mitigation steps. It also promotes coordination with supervisory authorities and reinforces accountability in breach handling. By requiring organizations to prioritize communication with data subjects in high-risk situations, Recital 86 strengthens trust, enhances transparency, and ensures individuals remain informed and protected.