Propose a change

Data (Use and Access) Act 2025

Write the words of this act the way you think they should read. Solon shows your change as a redline against the published text and pins it to that exact text, so it can never be applied to wording you did not see.

Change 1

What to do with it
As published

111 Duty to notify the Commissioner of personal data breach: time periods

(1) In regulation 5A of the PEC Regulations (personal data breach)— (a) in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and (b) after paragraph (3) insert— (3A) Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay. (2) In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)— (a) in paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, and (b) in paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”. (3) In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)— (a) in paragraph 2— (i) in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, (ii) in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and (iii) after the third subparagraph insert— This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. , and (b) for paragraph 3 substitute— 3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.

Your change, as a redline

111 Duty to notify the Commissioner of personal data breach: time periods

(1) In regulation 5A of the PEC Regulations (personal data breach)— (a) in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and (b) after paragraph (3) insert— (3A) Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay. (2) In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)— (a) in paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, and (b) in paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”. (3) In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)— (a) in paragraph 2— (i) in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, (ii) in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and (iii) after the third subparagraph insert— This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. , and (b) for paragraph 3 substitute— 3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.

One line that says what changes, such as "Halve the dog tax".

Who it helps, what it costs, what it fixes. It is what persuades people to support it.

A proposal here is not law. Support on Solon is evidence that people want the change; the official route says what it takes to make it law.

Sign in to file your proposal. What you have written stays on this page.

Sign in to file it

Think it through

Ask what your change would do, who would gain and who would bear a cost, and where something like it is already law. The assistant reads your draft as it stands, cites the law and the studies it finds, and takes no side. What you file stays yours.

Questions to start with
Think it through
Legal information from the published text, not advice for your case. Check the sources. Find a law · What the register holds