(2) The notification referred to in sub-section (1) shall include the following particulars— (a) (b) (c) (d) 33. nature of personal data which is the subject matter of the breach; number of data principals affected by the breach; possible consequences of the breach; and measures being taken by the data fiduciary to remedy the breach. (3) The notification referred to in sub-section (1) shall be made by the data fiduciary to the Authority as soon as possible and not later than the time period specified by the Authority, following the breach after accounting for any time that may be required to adopt any urgent measures to remedy the breach or mitigate any immediate harm. (4) Where it is not possible to provide all the information as set out in sub-section (2) at the same time, the data fiduciary shall provide such information to the Authority in phases without undue delay. (5) Upon receipt of notification, the Authority shall determine whether such breach should be reported by the data fiduciary to the data principal, taking into account the severity of the harm that may be caused to such data principal or whether some action is required on the part of the data principal to mitigate such harm. (6) The Authority, may in addition to requiring the data fiduciary to report the personal data breach to the data principal under sub-section (5), direct the data fiduciary to take appropriate remedial action as soon as possible andto conspicuously post the details of the personal data breach on its website. (7) The Authority may, in addition, also post the details of the personal data breach on its own website. Data Protection Impact Assessment. — (1) Where the data fiduciary intends to undertake any processing involving new technologies or large scale profiling or use of sensitive personal data such as genetic data or biometric data, or any other processing which carries a risk of significant harm to data principals, such processing shall not be commenced unless the data fiduciary has undertaken a data protection impact assessment in accordance with the provisions of this section. (2) The Authority may, in addition, specify those circumstances, or classes of data fiduciaries, or processing operations where such data protection impact assessment shall be mandatory, and may also specify those instances where a data auditor under this Act shall be engaged by the data fiduciary to undertake a data protection impact assessment. (3) A data protection impact assessment shall contain, at a minimum— (a) detailed description of the proposed processing operation, the purpose of processing and the nature of personal data being processed; 19