The breach of notification constitutes a minor infringement when the data was obtained from the person concerned (art. 39 C) and a major infringement when the data was not obtained from the person concerned (art. 40 C).

Mandatory breach notification

The law does provide for a mandatory breach duty. Notwithstanding, it provides that in the  case of a severe or major breach likely to affect a fundamental right or personal data the sanctioning organ may require the person responsible to restrain the use, communication, give out, or the  illegal transfer.