doc__heading__para__7

·Stronger protection against data breaches. The Regulation lays down a comprehensive set of rules on personal data breaches. It clearly defines what is a ‘personal data breach’, it introduces an obligation to notify the supervisory authority at the latest within 72 hours when the data breach is likely to pose a risk to the individual’s rights and freedoms. In certain circumstances, it obliges to inform the person whose data is concerned by the breach. This greatly reinforces the protection compared to the current situation in the EU, in which only electronic communication service providers, operators of essential services and digital service providers are obliged to notify data breaches under the Directive on privacy and electronic communications ('ePrivacy Directive') 7 and the Directive on the security of network and information systems (NIS) Directive 8 respectively;

← doc__heading__para__6 · All articles · doc__heading__para__8 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07 · Text as adopted (Official Journal); later amendments are not incorporated in this text.