Bavarian Data Protection Authority Issues New Guidance Paper On Handling Personal Data Breaches Under The General Data Protection Regulation

On 19 September 2016, the Bavarian Data Protection Authority ("DPA") issued a new guidance paper on handling personal data breaches under the new EU General Data Protection Regulation ("GDPR") in the course of a series of non-binding guidance papers on selected topics in relation to the GDPR, which the DPA publishes periodically. The papers can be found on the DPA's official website.

Starting Point: Current Legal Framework

The DPA states that there are a number of ways how personal data might fall into unauthorized hands. Already under the current legal framework, unauthorized access to personal data – colloquially: "data breaches" – has to be notified; however, only under certain circumstances. Pursuant to Section 42a of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), two requirements need to be fulfilled in order to trigger the obligation to notify: