Cyber Incident Response and Data Breach Notification (Germany)

A Practice Note addressing legal requirements and considerations when handling data breaches, cyberattacks, or other information security incidents in Germany or drafting data breach response notifications regarding personal data originating from Germany. It discusses the Federal Data Protection Act (BDSG) and operators of essential services’ obligations under the IT Security Act and IT Security Act 2.0. It also addresses related EU law, such as the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), the EU Directive on the Security of Network and Information Systems (Directive 2016/1148/EC) (NIS Directive), and Germany’s implementing laws. It also addresses the requirements in light of recent legislative developments such as the NIS 2 Directive (Directive (EU) 2022/2555) and the DORA-Regulation (Regulation (EU) 2022/2554). The Germany-specific guidance in this Note may be used with the generally applicable resources in the Global Cyber Incident Response and Data Breach Notification Toolkit.

Download the entire article (pdf)

Reproduced from Thomson Reuters Practical Law with the permission of the publishers. For further information, visit the Global Home page at uk.practicallaw.thomsonreuters.com