Informing the data subject is always necessary if a data breach has occurred and this has resulted in a high risk for the persons affected by the data breach.

Such a high-risk data breach always exists if a breach of data security has occurred (e.g. hacker attack) and a high risk has arisen as a result, e.g. because the hacker has demonstrably accessed the exposed data and the data in question is data that allows a noticeable invasion of privacy (e.g. identity theft, blackmail, advertisement). In such a case, in addition to informing the data protection supervisory authority responsible for the company, the data subjects must also be immediately informed. The legally defined information categories that need to be provided to the data subject include:

• name and contact details of the data protection officer or other contact point where more information can be obtained
• likely consequences of personal data breach
• description of measures taken or proposed to be taken by controller to address personal data breach (including measures to mitigate possible adverse effects).

In addition to the reporting requirements, the controller must document any personal data breach (including description, consequences of breach and remedial action taken).

The reporting of a data breach must be fulfilled by the controller. If the data breach takes place on the side of the processor, the latter is obliged to inform the controller. The deadline for such a processor notification is normally specified in a commissioned data processing agreement.