Where a personal data breach has occurred with respect to personal data being stored or processed by a data processor, the data processor shall, on becoming aware of the breach —

(a) notify the data controller or data processor that engaged it, describing the nature of the personal data breach including, where possible, the categories and approximate numbers of data subjects and personal data records concerned; and

(b) respond to all information requests from the data controller or data processor that engaged it, as they may require to comply with their obligations under this section.