4.
GDPR
If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.
← art_34__para_3__point_c__text_1 · All articles · art_34__para_4__text_1 →
Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.