http://www.legislation.gov.uk/eur/2013/611/article/2Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communicationsCommission Regulation (EU) No 611/2013Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communicationsKing's Printer of Acts of Parliamenthttps://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32013R0611texttext/xmlen2025-08-19Expert Participation2025-08-20 Notification to the <Substitution ChangeId="key-50e78713899789652c7c938f94ed85a5-1724925401586" CommentaryRef="key-50e78713899789652c7c938f94ed85a5">Information Commissioner</Substitution> Article 21The provider shall notify all personal data breaches to the Information Commissioner.2The provider shall notify the personal data breach to the Information Commissioner without undue delay and, where feasible, not later than 72 hours after having become aware of it.The provider shall , subject to paragraph 3, include in its notification to the Information Commissioner the information set out in Annex I.Detection of a personal data breach shall be deemed to have taken place when the provider has acquired sufficient awareness that a security incident has occurred that led to personal data being compromised, in order to make a meaningful notification as required under this Regulation. This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. 3To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.4The Information Commissioner shall provide to all providers established in the United Kingdom a secure electronic means for notification of personal data breaches and information on the procedures for its access and use. ...5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Words in Art. 2 heading substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(a); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(1) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(b); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(2) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(c); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(4) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(i); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(4) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(ii); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(4) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(e)(iii); 2020 c. 1, Sch. 5 para. 1(1)Art. 2(5) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 4(2)(f); 2020 c. 1, Sch. 5 para. 1(1)Words in Art. 2(2) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(i), 142(1); S.I. 2025/904, reg. 2(p)Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(ii), 142(1); S.I. 2025/904, reg. 2(p)Words in Art. 2(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(a)(iii), 142(1); S.I. 2025/904, reg. 2(p)Art. 2(3) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(3)(b), 142(1); S.I. 2025/904, reg. 2(p)