{
  "url": "https://openlegislation.uk/eu-regulation-2013-611/article-2",
  "json_url": "https://openlegislation.uk/eu-regulation-2013-611/article-2.json",
  "legislation": "eur/2013/611",
  "legislation_title": "Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2013-611",
  "path": "article/2",
  "kind": "article",
  "number": "2",
  "heading": "Notification to the Information Commission",
  "text": "1. The provider shall notify all personal data breaches to the Information Commission.\n2. The provider shall notify the personal data breach to the Information Commission without undue delay and, where feasible, not later than 72 hours after having become aware of it.\nThe provider shall , subject to paragraph 3, include in its notification to the Information Commission the information set out in Annex I.\nDetection of a personal data breach shall be deemed to have taken place when the provider has acquired sufficient awareness that a security incident has occurred that led to personal data being compromised, in order to make a meaningful notification as required under this Regulation.\nThis paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.\n3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.\n4. The Information Commission shall provide to all providers established in the United Kingdom a secure electronic means for notification of personal data breaches and information on the procedures for its access and use. ...\n5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Words in Art. 2(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(b); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in Art. 2(2) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(i), 142(1); S.I. 2025/904, reg. 2(p)"
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(ii), 142(1); S.I. 2025/904, reg. 2(p)"
    },
    {
      "type": "F",
      "label": "F4",
      "text": "Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(iii), 142(1); S.I. 2025/904, reg. 2(p)"
    },
    {
      "type": "F",
      "label": "F5",
      "text": "Art. 2(3) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(b), 142(1); S.I. 2025/904, reg. 2(p)"
    },
    {
      "type": "F",
      "label": "F6",
      "text": "Words in Art. 2(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(b); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F7",
      "text": "Words in Art. 2(4) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(ii); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F8",
      "text": "Words in Art. 2(4) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(iii); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F9",
      "text": "Art. 2(5) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(f); 2020 c. 1, Sch. 5 para. 1(1)"
    },
    {
      "type": "F",
      "label": "F10",
      "text": "Words in Art. 2 heading substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(a); S.I. 2026/1015, reg. 2(c)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2013/611/article/2",
    "retrieved_at": "2026-11-01T14:48:33.439016+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}