§ 59 DSG NRW
Notification of personal data breaches to the supervisory authority
(1)The procedure for the notification of personal data breaches to the supervisory authority pursuant to Article 33 of Regulation (EU) 2016/679 shall apply accordingly. Where the personal data breach concerns personal data that have been transmitted by or to the controller of another Member State, the information referred to in Article 33(3) of Regulation (EU) 2016/679 shall be transmitted to the controller of the Member State without delay. A notification pursuant to Article 33 of Regulation (EU) 2016/679 may only be used in criminal proceedings against the person subject to the notification obligation or one of his or her relatives referred to in Section 54(1) of the Code of Criminal Procedure with the latter's consent.
(2)The State Commissioner for Data Protection and Freedom of Information