Draft Law on the Protection of Privacy and Personal Data, breach notification

Art. 20 Wet Bescherming Privacy en Persoonsgegevens

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

This measure is a draft bill; it binds nobody yet. What follows is what it would require if it is enacted in this form.
Notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay, and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; if you do not notify within 72 hours, state the reasons for the delay.
Include in that notice, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, your data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
As a processor, inform the controller without unreasonable delay after becoming aware of a breach relating to personal data.
Document every breach relating to personal data, including the facts, its effects, and the corrective measures taken, in a form that lets the Commissioner verify your compliance with this duty.
Notify affected individuals of a breach relating to personal data if the Commissioner requires you to, using the communications and means the Commissioner specifies.

What it reaches

Obligation class

Breach notice

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

Article 20(1) requires a controller to notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay and, if possible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; where notice is not given within 72 hours, the controller must also state the reasons for the delay.

Article 20(2) requires that notice to describe, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, with article 20(3) allowing the information to be given in phases without unreasonable delay where it cannot all be given at once.

Article 16(j) requires a processor to inform the controller without unreasonable delay after becoming aware of a breach relating to personal data. Article 20(4) requires a controller to document every breach, including its facts, effects, and the corrective measures taken, in a form that lets the Commissioner verify compliance with the article.

Article 20(5) lets the Commissioner, after weighing the breach's nature, likely consequences, and mitigation measures, require the controller to notify affected individuals and specify the communications and means to use; article 20(6) has the Commissioner keep a non-public register of breach notifications it receives. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics
handles_health_records

Read the law

Draft text of the Ontwerpwet Bescherming Privacy en Persoonsgegevens
as republished by SRiS (Stichting voor de Rechtsorde in Suriname), a Surinamese legal-information foundation, not an official government gazette page the bill's current pendency before De Nationale Assemblee is confirmed on the National Assembly's own list of bills under consideration

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app