What should the Provider do if its security measures fail to protect personal data?
The Provider must notify Gen of any breaches, take corrective action, and cooperate with Gen in mitigating the breach.