On 12 September 2022, the Agency of Access to Public Information (AAIP) published the draft proposal for the Personal Data Protection Law and opened a public consultation until 30 September 2022. The Bill would require entities processing personal data to conduct risk assessments and implement preventive, detective, and responsive security measures to protect the personal data they store. The draft specifies that entities operating within the country will have to appoint a legal representative. Furthermore, the entities storing and processing personal data will have to notify the authorities of data breaches within 48 hours of their detection.
Original source