§ 10 LDSG SH
Notification of the data subject affected by a personal data breach
(1)The obligation to notify the data subject affected by a personal data breach pursuant to Article 34 of Regulation (EU) 2016/679 shall not apply, in addition to the exceptions referred to in Article 34(3) of Regulation (EU) 2016/679, insofar as and as long as 1. the notification would endanger public security or otherwise seriously prejudice the welfare of the Federation or a Land, 2. the notification would jeopardise the prosecution of criminal offences or administrative offences, 3. the personal data or the fact of their processing must be kept confidential pursuant to a legal provision or on account of the rights and freedoms of other persons, or 4. the notification would jeopardise the security of data processing systems.
(2)§ 8(2) and (3) sentence 1 shall apply mutatis mutandis.