Article 2 Notification to the Information CommissionF10

United Kingdom

The provider shall notify all personal data breaches to the F1Information Commission.

The provider shall notify the personal data breach to the Information Commission F2without undue delay and, where feasible, not later than 72 hours after having become aware of it.

The provider shall F3, subject to paragraph 3, include in its notification to the Information Commission the information set out in Annex I.

Detection of a personal data breach shall be deemed to have taken place when the provider has acquired sufficient awareness that a security incident has occurred that led to personal data being compromised, in order to make a meaningful notification as required under this Regulation.

F4This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

F53.

To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.

The F6Information Commission shall provide to all providers established in the F7United Kingdom a secure electronic means for notification of personal data breaches and information on the procedures for its access and use. F8...

F95.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1: Words in Art. 2(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(b); S.I. 2026/1015, reg. 2(c)
F2: Words in Art. 2(2) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(i), 142(1); S.I. 2025/904, reg. 2(p)
F3: Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(ii), 142(1); S.I. 2025/904, reg. 2(p)
F4: Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(iii), 142(1); S.I. 2025/904, reg. 2(p)
F5: Art. 2(3) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(b), 142(1); S.I. 2025/904, reg. 2(p)
F6: Words in Art. 2(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(b); S.I. 2026/1015, reg. 2(c)
F7: Words in Art. 2(4) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(ii); 2020 c. 1, Sch. 5 para. 1(1)
F8: Words in Art. 2(4) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(iii); 2020 c. 1, Sch. 5 para. 1(1)
F9: Art. 2(5) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(f); 2020 c. 1, Sch. 5 para. 1(1)
F10: Words in Art. 2 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(a); S.I. 2026/1015, reg. 2(c)