Communication of personal data breaches to data subjects
Article 5
Where the Commission is under an obligation to communicate a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall record and register the reasons for the restriction in accordance with Article 6 of this Decision. The Commission shall communicate the record to the European Data Protection Supervisor at the time of the notification of the personal data breach.