#
Breach-notification and security-measure duties are robust and in force, but the absence of DPO, formal DPIA, and general ROPA requirements — core GDPR-analogue accountability tools — represents a structural gap relative to omnibus peers.
Sub-modules (7)
Accountability And DpiaRed
No mandatory DPIA-equivalent process is codified in the APPI; accountability is achieved via security-control-measures and purpose-limitation duties.
Claims (1):
- The APPI does not impose a mandatory Data Protection Impact Assessment process equivalent to GDPR Article 35.
Dpo RequirementsRed
The APPI does not include a requirement to appoint a Data Protection Officer.
Claims (1):
- The APPI does not include a requirement to appoint a Data Protection Officer.
Ropa RequirementsAmber
No general Art 30-style records-of-processing duty exists; record-keeping obligations are narrower, attaching to third-party data-provision transactions with 3-year retention.
Claims (1):
- The amended Cabinet Order and Enforcement Rules impose record-keeping obligations on providers of personal data to third parties, covering confirmation of consent, date of provision, recipient details and data categories, generally retained for three years.
Joint Controller ArrangementsGreen
The APPI's 'joint use' mechanism functions as its joint-controllership analogue, requiring disclosure of the managing entity's identity and contact details.
Claims (1):
- Where a business relies on a 'joint use' mechanism to share personal data with others, the APPI requires disclosure of the address of the business managing the jointly used data and the name of its representative.
Security MeasuresGreen
Operators must implement organisational, personnel, physical and technical security-control measures, including 'understanding of the external environment' when data is processed abroad.
Claims (1):
- Businesses must implement organisational, personnel, physical and technical security-control measures over personal data, and the amended guidelines additionally require 'understanding of the external environment' when personal data is processed in a foreign country.
Breach NotificationGreen
Mandatory two-stage breach reporting to the PPC (preliminary + final) and subject notification apply to defined categories of data breach.
Claims (2):
- The amended APPI implements a legal obligation to report to the PPC and notify affected data subjects when a data breach (leakage, loss or damage) occurs or is likely to have occurred, replacing the prior mere 'duty to make an effort.'
- Breach reporting follows a two-stage process: a preliminary report filed promptly (generally within three to five days for corporations) after recognition of a potential breach, and a final report within 30 days (60 days for cyberattack-related breaches).
Retention And DisposalAmber
No general statutory retention-period ceiling exists; operators must delete personal data without delay once the purpose of use no longer requires it.
Claims (1):
- Business operators must delete personal data without delay once its utilisation is no longer necessary for the specified purpose, though the APPI does not fix a general maximum retention period.
Controller/Processor Duties
Two developments mark this module this cycle, one already in effect and one pending. The already-effective development is the Personal Information Protection Commission's formal alert of 7 October 2026, titled "Response to Large-Scale Leakage Incidents," issued directly to personal-information-handling business operators. The alert was prompted by a cluster of unauthorised-access breaches affecting widely-used consumer services, and it urges operators to review their safety-management measures and to delete personal data that is no longer needed. This is a primary-sourced, Confirmed development, and its significance lies in its timing relative to the pending statutory change discussed elsewhere in this brief: the PPC is acting now, under its existing powers, to raise expectations of controllers' security-measure practice, rather than waiting for Act No. 56/2026 or any associated Guidelines revision to take effect. The alert is understood to pre-empt a forthcoming revision to the PPC's Guidelines, suggesting that more detailed, binding or quasi-binding expectations may follow in due course, though the content and timing of that revision had not been established as at this cycle.
The pending development is Act No. 56/2026's introduction of a risk-based exemption from the requirement to directly notify affected individuals of a data breach. Under a revised Article 26(2), businesses would be exempted from direct individual notification where PPC regulations designate a particular breach as low-risk, provided alternative protective measures are taken instead. This is a meaningful adjustment to the current notification architecture, which otherwise generally requires both regulator notification and individual notification for qualifying breaches. Commencement for this exemption, and related provisions, has been reported variously: some reporting suggests certain provisions could commence as early as January 2027, while the main body of the Act is understood to commence around mid-2028. This discrepancy has not been resolved against a primary Cabinet-order source this cycle and should be treated as an open item.
Outlook
The immediate, practical item for controllers and processors is the PPC's live breach alert, which applies now under existing law regardless of Act No. 56/2026's commencement timetable; businesses handling consumer data, particularly in sectors recently affected by unauthorised-access incidents, should expect continued PPC attention to safety-management-measure adequacy. On the pending side, clarification of which specific provisions of the new breach-notification exemption commence on an accelerated timetable, as opposed to awaiting the main body's Cabinet-order date, together with the content of the PPC's anticipated Guidelines revision, are the two clearest open items to track in subsequent cycles.
2 earlier distinct update(s)
Controller/Processor Duties
Act No. 56 of 2026 makes two changes bearing on controller and processor duties, both enacted but not yet in force. First, entrusted data processors gain relief from most general APPI obligations, provided appropriate contractual safeguards are in place between the controller and the processor; this is a relaxation of the compliance burden for processors acting under contract, shifting more of the direct APPI compliance responsibility toward the controller relationship rather than duplicating it across both parties. Second, the PPC gains the power to issue a corrective order without first issuing a recommendation, where the PPC assesses that infringement risk is imminent. This removes the prior requirement that actual harm have already occurred before the PPC could act, giving the regulator a materially faster intervention tool.
Separately, and unaffected by this amendment, the existing APPI Article 26 breach-notification duty remains in force: a business operator that becomes aware of an actual or suspected personal-data breach falling within PPC-specified categories must report to the PPC and notify affected data subjects, with a preliminary report expected promptly and a final or supplementary report due within 30 days, extended to 60 days for breaches involving wrongful intent.
Outlook
The processor-relief and expedited-corrective-order provisions both depend on Act No. 56/2026's Cabinet Order commencement, expected no later than July 2028. Businesses relying on third-party processors should expect contractual-safeguard requirements to be specified in greater detail as the implementing rules develop, while the breach-notification regime itself continues unchanged under current law.
Controller/Processor Duties
The amendment exempts entrusted data processors from most of the APPI's general Chapter 4 obligations, provided the underlying processing agreement specifies prescribed matters, including breach-notification scope and use limitations. Under the current, already-in-force regime, APPI Article 26 requires business operators to report qualifying breaches to the PPC and notify affected individuals, and 2026 policy updates clarified reporting thresholds and introduced online-submission procedures for breach reports to the Commission.
Outlook
The processor exemption will not take effect until Cabinet-order commencement, due no later than July 2028, meaning entrusted-processor arrangements remain fully subject to Chapter 4 obligations in the interim. The Article 26 procedural clarifications, by contrast, are already operative.
Sources and claims (8)
- ConfirmedOneTrust DataGuidance — The APPI does not impose a mandatory Data Protection Impact Assessment process equivalent to GDPR Article 35.observed
- ConfirmedOneTrust DataGuidance — The APPI does not include a requirement to appoint a Data Protection Officer.observed
- ConfirmedIAPP — The amended Cabinet Order and Enforcement Rules impose record-keeping obligations on providers of personal data to third parties, covering confirmation of consent, date of provision, recipient details and data categories, generally retained for three years.observed
- ConfirmedIAPP — Where a business relies on a 'joint use' mechanism to share personal data with others, the APPI requires disclosure of the address of the business managing the jointly used data and the name of its representative.observed
- ConfirmedIAPP — Businesses must implement organisational, personnel, physical and technical security-control measures over personal data, and the amended guidelines additionally require 'understanding of the external environment' when personal data is processed in a foreign country.observed
- ConfirmedIAPP — The amended APPI implements a legal obligation to report to the PPC and notify affected data subjects when a data breach (leakage, loss or damage) occurs or is likely to have occurred, replacing the prior mere 'duty to make an effort.'observed
- ConfirmedIAPP — Breach reporting follows a two-stage process: a preliminary report filed promptly (generally within three to five days for corporations) after recognition of a potential breach, and a final report within 30 days (60 days for cyberattack-related breaches).observed
- ConfirmedOneTrust DataGuidance — Business operators must delete personal data without delay once its utilisation is no longer necessary for the specified purpose, though the APPI does not fix a general maximum retention period.observed