Article 34. Communication of a personal data breach to the data subject
(1) When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the personal data breach without undue delay.
(2) The information provided to the data subject as referred to in paragraph (1) shall include a description, in clear and plain language, of the nature of the personal data breach and at least the information and measures referred to in art. 33(3)(b)–(d).
(3) Informing the data subject as referred to in paragraph (1) shall not be required if one of the following conditions is met:
- a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access them, such as encryption;
- b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph (1) is no longer likely to materialise;
- c) it would involve disproportionate effort. In such a case, a public communication shall be made or a similar measure shall be taken whereby the data subjects are informed in an equally effective manner.
(4) If the controller has not informed the data subject of the personal data breach, the Centre, having considered the likelihood of the personal data breach resulting in a high risk, may require the controller to inform the data subject or may decide that one of the conditions referred to in paragraph (3) is met.