(ii) the Data Subject is not the subject of an investigation or suit that may require the Personal Data sought to be deleted. NITDA would consider the above and other circumstances to determine if the data was stored appropriately and for a reasonable length of time. 8.3 Personal Data that is no longer in use or which has been retained beyond the requisite statutorily required storage period, shall be destroyed in line with global best practices for such operations. Evidence of destruction of data shall be a valid defence against future allegation of breach by a Data Subject. 9.0 DATA PRIVACY BREACH (Art. 2.10; 4.1(8) NDPR) 9.1 In line with Article 4.1(8) and other relevant provisions, Data Subjects, civil societies or professional organisations or any government Agency may report a breach of this Regulation to NITDA through any of the advertised channels. Upon receipt of this report, NITDA may take any of the following actions: 9.2 a) contact the organisation for enquiry; b) review of earlier filed annual report (if any); c) issue a compliance query; d) commence other administrative actions; and e) report the defaulter for possible prosecution Data Controllers have a duty of self-reporting of Personal Data breaches to NITDA within 72 hours of knowledge of such breach. This timeline should be documented in the organisation’s data protection policy and data privacy policy. 9.3 A notification of data breach to NITDA must include the following information: 19 | P a g e