Regulation On The Measures Applicable To The Notification Of Personal Data Breach

The new Commission Regulation¹ outlining the measures to be taken by service providers² in the event of a personal data breach has come into effect and is binding upon Member States as of the 25th of August 2013. Although telecoms and ISPs³ in Europe have been subject to notification requirements already⁴, this regulation amends and creates more burdensome obligations on the providers with tighter deadlines and more detailed notifications requirements. It is intended to ensure the protection of privacy and that any breach thereof is notified in a consistent manner across the EU.

The providers of electronic communication services are now obliged to notify the competent national authority of a breach within 24 hours from its detection. Furthermore, should the data breach be likely to adversely affect personal data or privacy of the concerned subscriber or individual, the provider is also obliged to inform the subscriber directly. Personal Data Breaches are defined in