This paper analyses Data Breach Notification Duties from a jurisprudential perspective. DBNDs impose duties on people who are victims of a crime, duties whose violation in turn can trigger criminal sanctions. To analyze what type of duties a democratic society under the rule of law can impose on victims, we need a conceptual framework that links duties to participate in crime investigation and prosecution to specific roles a person can have in relation to a crime. Duff and Marshall have developed such a theory of the criminal law, which the paper applies to DBNLs, combining their approach with Floridi’s concept of the infosphere.