Communication to data subjects

Communication to data subjects under Article 34 GDPR is the direct information about a personal data breach. The controller must communicate the breach without undue delay when it is likely to result in a high risk to the rights and freedoms of natural persons. This threshold is higher than the threshold for notifying the supervisory authority under Article 33 GDPR. The topic on data breaches and notification duties explains how the two duties relate to each other.

Communication is not required where appropriate measures, such as effective encryption, made the data unintelligible to unauthorised persons, where subsequent measures mean that the high risk is no longer likely to materialise, or where individual communication would involve disproportionate effort. In the last case, a public communication or comparable measure must inform the affected people in an equally effective way. The 72-hour period under Article 33 GDPR concerns notification to the supervisory authority and does not automatically apply to communication with data subjects.

The communication must describe the nature of the breach in clear and plain language. It must include at least a contact point, the likely consequences and the measures taken or proposed to address the breach and, where appropriate, mitigate its adverse effects. Depending on the incident, practical advice such as changing a password may be necessary. The topic on data subject rights and access provides further context for the people affected.