§ 42 NDSG
Notification of data subjects affected by a personal data breach
(1)1Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall notify the data subjects of the incident without undue delay. 2Article 34 of the General Data Protection Regulation shall apply mutatis mutandis.
(2)The notification of data subjects pursuant to paragraph 1 may be dispensed with under the conditions referred to in Article 34(3) of the General Data Protection Regulation and may be deferred, restricted or dispensed with under the conditions referred to in § 51(3), provided that the interests of the data subject do not outweigh on account of the high risk arising from the breach within the meaning of paragraph 1.
(3)§ 41(2) shall apply mutatis mutandis.