# Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States, Article 3

Extent: E+W+S+N.I.

The factors determining whether a cyber-attack has a significant effect as referred to in Article 1(1) include any of the following:
(a) the scope, scale, impact or severity of disruption caused, including to economic and societal activities, essential services, critical State functions, public order or public safety;
(b) the number of natural or legal persons, entities or bodies affected;
(c) the number of Member States concerned;
(d) the amount of economic loss caused, such as through large-scale theft of funds, economic resources or intellectual property;
(e) the economic benefit gained by the perpetrator, for himself or for others;
(f) the amount or nature of data stolen or the scale of data breaches; or
(g) the nature of commercially sensitive data accessed.

---
Source: https://www.legislation.gov.uk/eudn/2019/797/article/3 (the official version)
Page: https://openlegislation.uk/eu-decision-2019-797/article-3
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.