breach within the time limit specified in paragraph (a), he shall provide the Commissioner with the reasons for the delay. (2) Where a processor becomes aware of a personal data breach, he shall notify the controller without any undue delay. (3) The notification referred to in subsection (1) shall – (a) describe the nature of the personal data breach, including where possible, the categories and approximate number of data subjects and the categories and approximate number of personal data records concerned; (b) communicate the name and contact details of any appropriate data protection officer or other contact point where more information may be obtained; and (c) recommend measures to address the personal data breach, including, where appropriate, measures to mitigate the possible adverse effects of the breach. (4) The controller shall specify the facts relating to the personal data breach, its effects and the remedial action taken so as to enable the Commissioner to verify compliance with this section. 26. Communication of personal data breach to data subject (1) Subject to subsection (3), where a personal data