On February 6, 2025, the EDÖB – PFPDT – IFPDT published a new guide on data breaches and informing the affected individuals (data breach), in accordance with Article 24 of the Federal Data Protection Act (LPD).
Key guidelines
1. Reporting security breaches to the IFPDT
• Notification subject
Description of the breach: nature, duration, scope, and consequences.
The IFPDT uses this information to assess possible actions to protect the affected individuals.
• Obligation to notify
Notification must be sent without delay if the breach underlines a high risk to the rights or personality of the individuals involved.
The notification must include all required information (Article 15 OPDa).
If the IFPDT learns of the breach from other sources, it may order an ex post notification.
• Right to communicate
Voluntary notifications can be made for breaches that do not present a high risk (these not through the portal), especially if there is a strong public or media interest.
• Submission of notification
Mandatory notifications must be sent via the official portal.
• Criteria for “High Risk”
- Severity of consequences (data sensitivity, type of breach, impact on affected individuals).
- Likelihood of consequences (the data controller should not wait for certainty before notifying).
• Sanctions
No direct sanction for failing to notify, however non-compliance with minimum security requirements can lead to criminal consequences (Article 61(c) LPD).
2. Information to affected individuals
• Obligation to Inform
Individuals must be notified if necessary for their protection (e.g., password change, credit card blocking) or at the order of the IFPDT.
The IFPDT may order communication for public interest reasons.
• Methods of information
Communication should be clear and understandable.
As a rule, individuals must be informed individually.
• Sanctions for failure to inform
The IFPDT can impose an obligation to inform even if delayed, in addition to other administrative measures.
This guide clarifies the responsibilities of organizations in the case of a data breach and emphasizes the importance of a proactive approach to security and transparency.
