§ 13 DSG NRW
Restriction of the notification of the data subject affected by a personal data breach pursuant to Article 34 of Regulation (EU) 2016/679
(1)The controller may refrain from notifying the data subject affected by a personal data breach insofar as and for as long as
(2)1. the information would jeopardise public safety or otherwise be detrimental to the welfare of the Federation or of a Land,
(3)2. the personal data or the fact of their processing must be kept confidential pursuant to a legal provision or on account of the rights and freedoms of other persons, or
(4)3. the information would jeopardise the security of IT systems.