a) a description of the circumstances of the loss or unauthorised access or disclosure; b) the date or time period during which the loss or unauthorised access or disclosure occurred; c) a description of the personal information involved in the loss or unauthorised access or disclosure; d) an assessment of the risk of harm to individuals as a result of the loss or unauthorised access or disclosure; e) an estimate of the number of individuals to whom there is a real risk of significant harm as a result of the loss or unauthorized access or disclosure; f) a description of steps the organization has taken to reduce the risk of harm to individuals; g) a description of any steps the organisation has taken to notify individuals of the loss or unauthorized access or disclosure, and h) the name and contact information for a person who can answer, on behalf of the organization, the Agency’s questions about the loss of unauthorized access or disclosure. 9.4 The Data Controller should immediately notify the Data Subject of the Personal Data breach where the personal data breach will likely result in high risks to the freedoms and rights of the data subject. 10.0 ENFORCEMENT FRAMEWORK (Art. 4.3a NDPR) 10.1 Forms of Enforcement 20 | P a g e