On August 7, 2018, the Personal Data Protection Commissioner (PDPC) released Public Consultation Paper (PCP) No. 1/2018 on the implementation of data breach notification. The consultation paper applies to “data users”, defined in the paper as “a person who either alone or jointly or in common with other processes any personal data or has control over or authorises the processing of any personal data”.