Data Protection Act, 2024, personal data breach notification

Data Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 14 January 2025.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the affected person's rights and freedoms, and give reasons for any later notification.
As a data processor, notify the data controller of a personal-data breach without undue delay after becoming aware of it.
Communicate a high-risk personal-data breach to the affected data subject without undue delay.

What it reaches

Obligation class

Breach notice

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 63(1) requires a data controller to notify the Information and Data Protection Commission of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject, and section 63(2) requires reasons for any later notification.

Section 63(3) requires a data processor to notify the data controller of a personal-data breach without undue delay after becoming aware of it. Section 64(1) requires the data controller to communicate a personal-data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to that person's rights and freedoms.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

Read the law

Data Protection Act
2024, Government Gazette Extraordinary Vol. LXII, No. 144 of 29 October 2024, reproduced by dpo-india.com, with the commencement day from the Botswana Laws bulletin entry for the Act

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app