LiechtensteinDSG Breach Notification in Liechtenstein
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the competent supervisory authority, the Datenschutzstelle in Liechtenstein, of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Communicate a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons to the data subjects without undue delay.
These lines are LexLint's reading of the law's text. Also read by: Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datenschutzstelle.li/rechtsgrundlagen/faqs-zur-dsgvo
- Guidance body
- Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein
What it makes you log
Logging duty
In the criminal-justice field Article 64(5) requires the controller to document every personal data breach, with all the facts of the incident, its effects and the remedial measures taken. That is a record of every breach, notified or not, and the clause names no content from the log vocabulary. Article 64 does not say the Datenschutzstelle may demand the documentation, so no audit or access route is coded from it; the GDPR Article 33(5) equivalent for general processing is not a section this row can pin from the Act's own text and is left out of the keys. Articles 43 and 65 and GDPR Articles 33(1) to (4) and 34 are notice duties and bars on use, with no record. No scope clause is invoked, so no territorial hook is coded.
- Kind
- Explicit
- As of
- Provision
- DSG Article 64(5)
- Trigger
- security_incident
What this law does
A controller must notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33(1) of the General Data Protection Regulation (GDPR)).
Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate it to the data subject without undue delay (Article 34(1) of the GDPR). Article 43 of the DSG bars the use of a notification under Article 33 of the GDPR, or of a communication under Article 34(1), in criminal proceedings under Articles 41 and 42 of the DSG against the person who gave it or that person's listed relatives, unless that person consents.
For processing by the public bodies responsible for preventing, investigating, detecting or prosecuting criminal offenses, Article 64 of the DSG requires the controller to notify a breach to the Datenschutzstelle without undue delay and if possible within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
In that field, Article 65 of the DSG requires the controller to notify the data subjects without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .