{
  "url": "https://openlegislation.uk/eu-regulation-2013-611/article-4",
  "json_url": "https://openlegislation.uk/eu-regulation-2013-611/article-4.json",
  "legislation": "eur/2013/611",
  "legislation_title": "Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2013-611",
  "path": "article/4",
  "kind": "article",
  "number": "4",
  "heading": "Technological protection measures",
  "text": "1. In derogation from Article 3(1), notification of a personal data breach to a subscriber or individual concerned shall not be required if the provider has demonstrated to the satisfaction of the Information Commission that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the security breach. Such technological protection measures shall render the data unintelligible to any person who is not authorised to access it.\n2. Data shall be considered unintelligible if:\n(a) it has been securely encrypted with a standardised algorithm, the key used to decrypt the data has not been compromised in any security breach, and the key used to decrypt the data has been generated so that it cannot be ascertained by available technological means by any person who is not authorised to access the key; or\n(b) it has been replaced by its hashed value calculated with a standardised cryptographic keyed hash function, the key used to hash the data has not been compromised in any security breach, and the key used to hash the data has been generated in a way that it cannot be ascertained by available technological means by any person who is not authorised to access the key.\n3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Words in Art. 4(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 39(2)(d); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Art. 4(3) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(4)(b); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2013/611/article/4",
    "retrieved_at": "2026-11-01T14:48:33.439016+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}