§ 12 SDSG
Restriction of the notification of the person affected by a breach of the protection of personal data
(1)pursuant to Article 34 of Regulation (EU) 2016/679
(2)In addition to Article 34(3) of Regulation (EU) 2016/679, the controller shall refrain from notifying the person affected by a breach of the protection of personal data insofar as and for as long as 1. the information would endanger public security or be detrimental to the welfare of the Federation or a Land, 2. this is necessary for the prevention, investigation, detection or prosecution of criminal offences or administrative offences, 3. the personal data or the fact of their processing must be kept secret for the protection of the data subject or the rights and freedoms of other persons, or 4. the information would endanger the security of information technology systems.
(3)Section 10(3) shall apply accordingly.