1. A joint controller that becomes aware of a personal data breach shall notify all the other joint controllers of the breach without undue delay, and at the latest within 24 hours after having become aware of the occurrence of the personal data breach.
2. The joint controller that caused the personal data breach or to whom the personal data breach is attributable, including breaches caused by or attributable to its processors or sub-processors, shall be responsible for managing that personal data breach in accordance with Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively. If it cannot be determined which joint controller is responsible within 24 hours of receipt of the notification referred to in paragraph 1, all the joint controllers shall be responsible for managing the personal data breach.
3. The joint controller responsible under paragraph 2 shall, in particular, notify its supervisory authority and inform the data subject of the personal data breach, if appropriate. The ECB shall also notify the personal data breach to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons, even if it is not the joint controller responsible.
4. The joint controller responsible under paragraph 2 shall notify all the other joint controllers without undue delay of (a) the measures applied by the joint controller to mitigate the risks arising from the personal data breach; and (b) whether the data breach has been or will be notified to the supervisory authority and communicated to the data subject.