12.2.1 make the required report of a data breach to the Information Office without Commissioner’s undue delay and, where possible within 72 hours of becoming aware of it, if it is likely to result in a risk to the rights and freedoms of individuals; and 12.2.2 notify the affected individuals if a data breach is likely to result in a high risk to their rights and freedoms and notification is required by law. 13. International transfers 13.1 [The Company will not transfer personal information outside the European Economic Area (EEA), which comprises the countries in the European Union and Iceland, Liechtenstein and Norway. [OR The Company may transfer personal information outside the European Economic Area (EEA) (which comprises the countries in the European Union and Iceland, Liechtenstein and Norway) to [insert name of country] on the basis [that that country, territory or organisation is designated as having an adequate level of protection OR that the organisation receiving the information has provided adequate safeguards by way of [binding corporate rules OR standard data protection clauses OR of compliance with an approved code of conduct]].] 14. Consequences of failing to comply 14.1 The Company takes compliance with this policy very seriously. Due to the importance of this policy, an failure to comply with any requirement of it may lead to disciplinary employee’s action under our procedures, and this action may result in dismissal for gross misconduct. If a non-employee breaches this policy, they may have their contract terminated with immediate effect.
12.2.1 make the required report of a data breach to the Information Commissioner’s Office without undue delay and, where possible within 72 hours of becoming aware of it, if it is likely to result in a risk to the rights and freedoms of individuals; and 12.2.2 notify the affected individuals if a data breach is likely to result in a high risk to their rights and freedoms and notification is required by law. 13. International transfers 13.1 [The Company will not transfer personal information outside the European Economic Area (EEA), which comprises the countries in the European Union and Iceland, Liechtenstein and Norway. [OR The Company may transfer personal information outside the European Economic Area (EEA) (which comprises the countries in the European Union and Iceland, Liechtenstein and Norway) to [insert name of country] on the basis [that that country, territory or organisation is designated as having an adequate level of protection OR that the organisation receiving the information has provided adequate safeguards by way of [binding corporate rules OR standard data protection clauses OR of compliance with an approved code of conduct]].] 14. Consequences of failing to comply 14.1 The Company takes compliance with this policy very seriously. Due to the importance of this policy, an employee’s failure to comply with any requirement of it may lead to disciplinary action under our procedures, and this action may result in dismissal for gross misconduct. If a non-employee breaches this policy, they may have their contract terminated with immediate effect.