Exceptions to informing data subjects of data breaches
The obligation to inform the data subject of a personal data breach according to Art. 34 GDPR does not apply if it would disclose confidential information, which by law or by its nature must be kept secret, particularly regarding because of overriding legitimate interests of a third party. The data subjects have to be informed if their interests outweigh the interests of secrecy (Sec. 29 BDSG).
