§ 10 NDSG
Restriction of the notification obligation pursuant to Article 34 of the General Data Protection Regulation
(1)The controllers may refrain from notification pursuant to Article 34 of the General Data Protection Regulation insofar as and as long as
(2)the notification would endanger public security or otherwise prejudice the welfare of the Federation or a Land,
(3)this is necessary for the prosecution of criminal offences or administrative offences,
(4)the notification would lead to the disclosure of a matter which is to be kept confidential pursuant to a legal provision in the public interest or on account of the rights and freedoms of another person, or
(5)the notification would endanger the security of automated information systems.