Germany

Under this regulatory regime, it is required that there should be the perpetual establishment of a proper legal basis under which the statutory requirement shall be fulfilled under Article 6(1)(c) of the GDPR, and there should also be continuous provision of transparent privacy notices to the clients about monitoring and storage of data. This process of privacy data management is not something sporadic but is performed concurrently with customer monitoring. In addition, it includes specific time-bound benchmarks for performance, and companies are required to implement standard data processing policies and respond to data subject access requests, as well as investigations carried out by data protection authorities, within 1 month deadline (which can be extended to 3 months in cases of complicated architecture), except when limited under AML exemptions to avoid tipping off suspects.

In accordance with GDPR and the BDSG, the obligation to report a personal data breach in Germany is an event-based one, which is characterized by a very strict and divided time value of 72 hours. The above-described legal requirement entails the following: when a company or a financial institution learns about any incident leading to the unauthorized access to, the altering, and the loss of the personal data, the reporting obligation arises. At that, the reporting entity should contact the respective regional State Data Protection Authority (Landesdatenschutzbehörde) within no more than 72 hours with the information about the breach, the type of data that was breached, and the measures taken in order to prevent further negative consequences. In case the reported incident poses a threat to individual rights and can lead to identity theft and financial fraud of the clients, the affected individuals have to be informed without any delays.