Data Breach Notification Requirements in Germany

What the Law Says

Germany implements the EU GDPR (DSGVO) directly, supplemented by the national Bundesdatenschutzgesetz (BDSG). Breach notification obligations derive primarily from Art. 33–34 DSGVO, with procedural specifics governed by German administrative law and BfDI guidance.

Under Art. 33(1) DSGVO, a controller must notify the competent supervisory authority — in Germany, the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI) — of a personal data breach ‘without undue delay and, where feasible, not later than 72 hours after having become aware of it’, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

Where the breach is likely to result in a ‘high risk’ to the rights and freedoms of natural persons, Art. 34(1) DSGVO requires the controller to communicate the breach to the affected individuals ‘without undue delay’. Exemptions apply if appropriate technical/organizational measures (e.g., encryption) were applied, or if subsequent measures effectively mitigate the risk (Art. 34(3) DSGVO). The BDSG does not modify these core obligations but clarifies jurisdictional competence for public vs. private sector controllers (§ 18–19 BDSG).

Statutory Text

The controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority…

— DSGVO Art. 33(1)

Statutory Text

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

— DSGVO Art. 34(1)

What to Do

Sources

Related Questions