# Breach response support Source: https://conformitate.md/en/services/breach-response-support Services In the case of a personal data breach, the controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours, unless the breach is unlikely to result in a risk (art. 33(1)). Where the risk is high, it informs the data subjects (art. 34(1)). Dealing with a breach right now? Call: [+373 767 27 667](tel:+37376727667) Monday to Friday, 9:00–18:00. Outside these hours, write to [contact@conformitate.md](mailto:contact@conformitate.md) and we reply on the morning of the next working day. The 72 hours for notifying the Centre also run over weekends and public holidays. [art. 33(1)](https://conformitate.md/en/law-195-2024/article-33#p1 "Notification of a personal data breach to the Centre") ## What the Law provides 1. Article 33 [Notification of a personal data breach to the Centre](https://conformitate.md/en/law-195-2024/article-33) 2. Article 34 [Communication of a personal data breach to the data subject](https://conformitate.md/en/law-195-2024/article-34) ## What we deliver - ✓ Assessment of the risk to the rights and freedoms of natural persons - ✓ Notification to the Centre, where required - ✓ Communication to data subjects, where the risk is high - ✓ Documentation of the breach, its effects and the remedial action taken For whom Controllers that have discovered a personal data breach, and processors, which must notify the controller without undue delay. What you get The risk assessed, the Centre notified and the data subjects informed where the Law requires it, and the case documented so that the Centre can verify compliance with art. 33. The time limit of no more than 72 hours, which applies where feasible, runs from when the controller became aware of the breach, and a notification made after 72 hours is accompanied by the reasons for the delay. Timeframe Monday to Friday, 9:00–18:00, you can call us; outside these hours, email us and we reply on the morning of the next working day. The work is charged by the hour, for as long as the case requires. What you give us - What happened and when you became aware of the breach - Which data and how many people are affected, as far as you know - The measures already taken to stop the breach or limit its effects - Contact details of the IT supplier or processor involved Breach support 1,000 MDL / hour [Ask for help →](https://conformitate.md/en/services/breach-response-support?pkg=incident#oferta) ## How we work - We sign a contract and issue an invoice. - Work starts once the contract is signed. - On request, we sign a confidentiality agreement (NDA). - We deliver the documents by email, signed if you ask. FAQ ## Questions about this service ### Does the 72-hour time limit run over the weekend? Yes. It is counted in hours from when the controller became aware of the breach, not in working days, so it includes weekends and public holidays. A notification made after 72 hours is accompanied by the reasons for the delay. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### What if we do not have all the information yet? Notify within the time limit anyway. Where, and in so far as, it is not possible to provide the information at the same time, it may be provided in phases without undue further delay. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### Does every incident have to be notified to the Centre? No. Notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Every breach must still be documented, including those you do not notify. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### Will notifying the breach get us fined? Notification is an obligation, not an admission of fault. When deciding whether to impose a fine and on its amount, the Centre takes into account, among other things, the action taken to mitigate the damage, the degree of cooperation with the Centre and the manner in which it learned of the breach, in particular whether the controller notified it. [art. 87](https://conformitate.md/en/law-195-2024/article-87 "General conditions for imposing fines") Related pages [Security of processing](https://conformitate.md/en/law-195-2024/security-and-breaches) [Medical & dental clinics](https://conformitate.md/en/industries/medical-clinics) [Accounting firms](https://conformitate.md/en/industries/accounting-firms) [Online stores](https://conformitate.md/en/industries/online-stores) [Homeowners associations](https://conformitate.md/en/industries/homeowners-associations) [Personal data breach: what to do](https://conformitate.md/en/situations/data-breach) [Case study: medical clinic](https://conformitate.md/en/case-studies/medical-clinic) [Case study: accounting firm](https://conformitate.md/en/case-studies/accounting-firm) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing