Where personal information has been or may be leaked, falsified, or lost, the personal information processor shall immediately take remedial measures and inform the department performing duties of personal information protection and the individuals concerned. The notice shall include the following particulars:
(I) types and causes of personal information leakage, falsification, and loss that have occurred or may occur and the possible harm caused;
(II) remedial measures taken by personal information processors and measures taken by individuals to mitigate harm;
(III) contact information of the personal information processor.
If the personal information processor has taken measures to effectively avoid harm caused by information leakage, falsification, or loss, it may opt not to notify the individuals; however, if the department performing duties of personal information protection believes harm shall be caused, it may require the personal information processor to notify the individuals thereof.