Notify a personal data breach to your Data Protection Authority (DPA)
All data breaches should be notified to the relevant DPA, except for those unlikely to present any risk to individuals, according to Art. 33 GDPR.
If the breach takes place in the context of cross-border processing, the data controller will need to notify the lead DPA or, at a minimum, the local DPA where the breach has taken place.
Where a data controller does not have a main establishment in the EEA, the one-stop-shop mechanism does not apply. Therefore, in such cases the breach will need to be notified to every DPA for which affected individuals reside in their country.
To facilitate this notification, DPAs have implemented procedures and online forms guiding you through this process.
Österreich
Österreichische Datenschutzbehörde
(Austrian Data Protection Authority)
The data breach notification is accepted in German.
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
Austria
[email protected]
http://www.dsb.gv.at/
Belgien
Autorité de la protection des données - Gegevensbeschermingsautoriteit (APD-GBA)
Rue de la Presse 35 – Drukpersstraat 35
1000 Bruxelles - Brussel
Belgium
[email protected]
https://www.autoriteprotectiondonnees.be
https://www.gegevensbeschermingsautoriteit.be
Bulgarien
Commission for Personal Data Protection of the Republic of Bulgaria
(Bulgarian Data Protection Authority)
The information on data breach notification are also available in English and French.
The data breach notification is accepted in Bulgarian.
Commission for Personal Data Protection
2, Prof. Tsvetan Lazarov blvd.
1592 Sofia
Bulgaria
[email protected]
https://www.cpdp.bg/
Kroatien
Agencija za zaštitu osobnih podataka (AZOP)
(Croatian Personal Data Protection Agency)
The data breach notification is accepted in Croatian or English.
Croatian Personal Data Protection Agency
Selska Cesta 136
10000 Zagreb
Croatia
[email protected]
http://www.azop.hr/
Zypern
Office of the Commissioner for Personal Data Protection
(Cypriot Data Protection Authority)
The data breach notification is accepted in Greek, or in English in cases where the breach concerns cross-border processing.
Commissioner for Personal Data Protection
15, Kypranoros Street
1061 Nicosia
P.O. Box. 23378
1682 Nicosia
Cyprus
[email protected]
http://www.dataprotection.gov.cy/
Tschechische Republik
Office for Personal Data Protection
(Czech Data Protection Authority)
Notify a data breach:
- Data breach information
- Data breach form (Czech)
- Send the notification form by email to [email protected]
The data breach notification is accepted in Czech and English.
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
[email protected]
http://www.uoou.cz/
Dänemark
Datatilsynet
(Danish Data Protection Authority)
Danish companies and natural persons can submit the notification online, while everyone can send it by email to [email protected].
The data breach notification is accepted in Swedish, Norwegian or English.
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
[email protected]
http://www.datatilsynet.dk/
Estland
Estonian Data Protection Inspectorate
(Estonian Data Protection Authority)
Personal data breach notifications can be reported:
- Filling out the form in Estonian or English, and send it by email to [email protected]
- Submit the notification via specific e-service. Service can be used by persons having national eID carriers like ID-card, Mobile-ID or Smart-ID.
The data breach notification is accepted in Estonian or English.
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39
10134 Tallinn
Estonia
[email protected]
http://www.aki.ee/
Finnland
Office of the Data Protection Ombudsman
(Finnish Data Protection Authority)
The data breach notification is accepted in Finnish, Swedish or English.
Office of the Data Protection Ombudsman
P.O. Box 800
FI-00531 Helsinki
Finland
[email protected]
http://www.tietosuoja.fi/en/
Frankreich
Commission Nationale de l'Informatique et des Libertés - CNIL
(French Data Protection Authority)
The data breach notification is accepted in French.
Commission Nationale de l'Informatique et des Libertés - CNIL
3 Place de Fontenoy
TSA 80715 – 75334 Paris, Cedex 07
France
http://www.cnil.fr/
https://www.cnil.fr/en/contact-cnil
Deutschland
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Federal Commissioner for Data Protection and Freedom of Information
The data breach notification is accepted in German.
Data Protection Authority of Mecklenburg-Western Pomerania
The data breach notification is accepted in German or English.
The Rhineland-Palatinate State Commissioner for Data Protection and freedom of information
The data breach notification is accepted in German or English.
Der Landesbeauftragte für den Datenschutz Niedersachsen
The data breach notification is accepted in German or English.
Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Office of the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information)
The data breach notification is accepted in German or English.
Bayerisches Landesamt für Datenschutzaufsicht
Bavarian Data Protection Authority for the Private Sector
The data breach notification is accepted in German or English.
Berliner Beauftragte für Datenschutz und Informationsfreiheit
The data breach notification is accepted in German.
Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg
The Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg)
The data breach notification is accepted in German or English.
The Hessian Commissioner for Data Protection and Freedom of Information
The data breach notification is accepted in German.
Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Brandenburg Commissioner for Data Protection and Access to Information
The data breach notification is accepted in German or English.
Unabhängiges Datenschutzzentrum Saarland
The data breach notification is accepted in German.
Landesbeauftragte für Datenschutz Schleswig-Holsetin
Email: [email protected]
The data breach notification is accepted in German or English.
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
The Data Protection Commissioner of Saxony-Anhalt
The data breach notification is accepted in German or English.
Saxon Data Protection and Transparency Commissioner
The data breach notification is accepted in German or English.
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit
The Commissioner for Data Protection and Freedom of Information Thüringen
Notify a data breach:
- Fill in the form and send it by email to [email protected]
- Fill in the form and send it by post to Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Postfach 900455 - 99107 Erfurt
The data breach notification is accepted or German.
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
The Hamburg Commissioner for Data Protection and Freedom of Information
The data breach notification is accepted in German or English.
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Straße 153
53117 Bonn
Germany
[email protected]
http://www.bfdi.bund.de/
Griechenland
Hellenic Data Protection Authority
(Greek Data Protection Authority)
Notify a data breach:
The data breach notification is accepted in Greek or English.
Hellenic Data Protection Authority
Kifisias Av. 1-3
11523 Ampelokipi Athens
Greece
[email protected]
http://www.dpa.gr/
Ungarn
Nemzeti Adatvédelmi és Információszabadság Hatóság / Hungarian National Authority for Data Protection and Freedom of Information
(Hungarian Data Protection Authority)
Notify a data breach:
- by post: download the notification form and send it to the Hungarian DPA at 1363 Budapest, Pf.: 9.; Hungary
- by email: download the notification form and send it to [email protected]
- online: on the Hungarian DPA notification surface
- on the Hungarian DPA's electronic administration interface (e-papir)
The personal data breach notification portal is only for personal data breach notifications for data controllers, it is not possible to submit complaints.
The data breach notification is accepted in Hungarian, preliminary notifications are also accepted in English, but it is mandatory to submit them later in Hungarian.
Hungarian National Authority for Data Protection and Freedom of Information
Falk Miksa utca 9-11
H-1055 Budapest
Hungary
[email protected]
http://www.naih.hu/
Island
- Data controllers can submit a data breach notification by filling the online form.
- Individuals that want to report on a potential data breach can do so via email at [email protected]
The data breach notification is accepted in Icelandic, or in English in cases where the breach concerns cross-border processing.
Irland
Data Protection Commission - DPC
(Irish Data Protection Authority)
The data breach notification is accepted in Irish or English.
Data Protection Commission
21 Fitzwilliam Square
D02 RD28 Dublin 2
Ireland
[email protected]
http://www.dataprotection.ie/
Italien
Garante per la protezione dei dati personali
(Italian Data Protection Authority)
The data breach notification is accepted in Italian.
Garante per la protezione dei dati personali
Piazza Venezia, 11
00187 Roma
Italy
[email protected]
http://www.garanteprivacy.it/
Lettland
Data State Inspectorate
(Latvian Data Protection Authority)
The data breach notification is accepted in Latvian.
Data State Inspectorate
Elijas Street 17
LV-1050 Riga
Latvia
[email protected]
https://www.dvi.gov.lv/
Liechtenstein
Data Protection Authority Principality of Liechtenstein
Notify a data breach:
The data breach notification is accepted in German or English.
Data Protection Authority, Principality of Liechtenstein
Kirchstrasse 8
9490 Vaduz
Liechtenstein
[email protected]
https://www.datenschutzstelle.li
Litauen
State Data Protection Inspectorate
(Lithuanian Data Protection Authority)
Further information:
- Notification of a Personal Data Breach to the State Data Protection Inspectorate (English)
- Notification form (English)
- Privacy notice
- Link to e-service
The data breach notification is accepted in Lithuanian. Documents in English are only for information
State Data Protection Inspectorate
L. Sapiegos str. 17
LT-10312 Vilnius
Lithuania
[email protected]
https://vdai.lrv.lt/
Luxemburg
Commission Nationale pour la Protection des Données
(Luxembourgish Data Protection Authority)
Notify a data breach:
- Fill in the form
- Send it by email to [email protected] or by post to Commission nationale pour la protection des données, 15, Boulevard du Jazz I L-4370 Belvaux
The data breach notification is accepted in French, German or English.
Commission Nationale pour la Protection des Données
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg
[email protected]
http://www.cnpd.lu/
Malta
Office of the Information and Data Protection Commissioner
(Maltese Data Protection Authority)
The data breach notification is accepted in English or Maltese.
Office of the Information and Data Protection Commissioner
Second Floor, Airways House
High Street
SLM 1549 Sliema
Malta
[email protected]
http://www.idpc.org.mt/
Niederlande
Autoriteit Persoonsgegevens
(Dutch Data Protection Authority)
The data breach notification is accepted in Dutch or English.
Autoriteit Persoonsgegevens
Hoge Nieuwstraat 8
P.O. Box 93374
2509 AJ Den Haag/The Hague
Netherlands
https://autoriteitpersoonsgegevens.nl/
Norwegen
Datatilsynet
(Norwegian Data Protection Authority)
Notify a data breach:
- Online guidance
- By email to [email protected].
There is no specific form to use to notify a personal data breach by email, the online guidance provides the information that is expected to be received with a personal data breach notification.
The data breach notification is accepted in Norwegian, Danish, Swedish or English.
Datatilsynet
P.O. Box 458 Sentrum
0150 Oslo
Norway
[email protected]
https://www.datatilsynet.no
Polen
Urząd Ochrony Danych Osobowych
(Polish Data Protection Authority)
The data breach notification is accepted in Polish, the English translation of the form available on the website is for information purposes only.
Urząd Ochrony Danych Osobowych (Personal Data Protection Office)
ul. Stawki 2
00-193 Warsaw
Poland
[email protected]
https://uodo.gov.pl/
Portugal
Comissão Nacional de Proteção de Dados (CNPD)
(Portuguese Data Protection Authority)
The data breach notification is accepted in Portuguese.
Comissão Nacional de Proteção de Dados - CNPD
Av. D. Carlos I, 134, 1º
1200-651 Lisboa
Portugal
[email protected]
http://www.cnpd.pt/
Rumänien
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal
(Romanian Data Protection Authority)
The data breach notification is accepted in Romanian or English.
The National Supervisory Authority for Personal Data Processing
B-dul Magheru 28-30
Sector 1 BUCUREŞTI
Romania
[email protected]
http://www.dataprotection.ro/
Slowakei
Office for Personal Data Protection of the Slovak Republic
(Slovak Data Protection Authority)
The data breach notification is accepted in Slovak.
Office for Personal Data Protection of the Slovak Republic
Hraničná 12
820 07 Bratislava 27
Slovakia
[email protected]
http://www.dataprotection.gov.sk/
Slowenien
Information Commissioner of the Republic of Slovenia
(Slovenian Data Protection Authority)
Notify a data breach:
- Fill in the form (docx)
- In case of cross-border data breach, please fill in the additional form (docx)
- Send the form(s) by email: [email protected]
The data breach notification is accepted in Slovenian.
Information Commissioner of the Republic of Slovenia
Dunajska 22
1000 Ljubljana
Slovenia
[email protected]
https://www.ip-rs.si/
Spanien
Agencia Española de Protección de Datos
(Spanish Data Protection Authority)
Notify a data breach:
- Fill in the online form
- Only for controllers not established in the Union, fill in the pdf form completely, digitally sign and submit to [email protected]
The data breach notification is accepted in Spanish or English.
Agencia Española de Protección de Datos (AEPD)
C/Jorge Juan, 6
28001 Madrid
Spain
[email protected]
https://www.aepd.es/
Schweden
Integritetsskyddmyndigheten
(Swedish Data Protection Authority)
Notify a data breach:
The data breach notification is accepted in Swedish or English.
Integritetsskyddsmyndigheten
Drottninggatan 29
5th Floor
Box 8114
104 20 Stockholm
Sweden
[email protected]
http://www.imy.se/