What it asks for. When a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform them without undue delay, in clear and plain language. Communication is not required in certain cases, for example where the data were rendered unintelligible by encryption, subsequent measures mean the high risk is no longer likely, or individual contact would involve disproportionate effort, in which case a public communication is used.
In practice. Organisations include individual notification in their breach procedure, with criteria for assessing high risk and templates that explain what happened, likely consequences, measures taken and practical advice. Evidence includes the risk assessment, the decision, copies of communications and any instruction from the supervisory authority.
Common gaps. Notifications are often delayed while facts are confirmed, or written in vague language that does not help people protect themselves. Reliance on encryption is claimed without checking that keys were not compromised.