# Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications, Article 2: Notification to the Information Commission

Extent: E+W+S+N.I.

1. The provider shall notify all personal data breaches to the Information Commission.
2. The provider shall notify the personal data breach to the Information Commission without undue delay and, where feasible, not later than 72 hours after having become aware of it.
The provider shall , subject to paragraph 3, include in its notification to the Information Commission the information set out in Annex I.
Detection of a personal data breach shall be deemed to have taken place when the provider has acquired sufficient awareness that a security incident has occurred that led to personal data being compromised, in order to make a meaningful notification as required under this Regulation.
This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.
3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.
4. The Information Commission shall provide to all providers established in the United Kingdom a secure electronic means for notification of personal data breaches and information on the procedures for its access and use. ...
5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

---
Source: https://www.legislation.gov.uk/eur/2013/611/article/2 (the official version)
Page: https://openlegislation.uk/eu-regulation-2013-611/article-2
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.