- Latest available (Revised)
- Original (As made)
The Privacy and Electronic Communications (EC Directive) Regulations 2003, Section 5A is up to date with all changes known to be in force on or before 24 August 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
5A.—(1) In this regulation and in regulations 5B and 5C, “service provider” has the meaning given in regulation 5(1).
(2) If a personal data breach occurs, the service provider shall, without undue delay, notify that breach to the Information Commissioner.
(3) Subject to paragraph (6), if a personal data breach is likely to adversely affect the personal data or privacy of a subscriber or user, the service provider shall also, without undue delay, notify that breach to the subscriber or user concerned.
(4) The notification referred to in paragraph (2) shall contain at least a description of—
(a)the nature of the breach;
(b)the consequences of the breach; and
(c)the measures taken or proposed to be taken by the provider to address the breach.
(5) The notification referred to the paragraph (3) shall contain at least—
(a)a description of the nature of the breach;
(b)information about contact points within the service provider’s organisation from which more information may be obtained; and
(c)recommendations of measures to allow the subscriber to mitigate the possible adverse impacts of the breach.
(6) The notification referred to in paragraph (3) is not required if the service provider has demonstrated, to the satisfaction of the Information Commissioner that—
(a)it has implemented appropriate technological protection measures which render the data unintelligible to any person who is not authorised to access it, and
(b)that those measures were applied to the data concerned in that breach.
(7) If the service provider has not notified the subscriber or user in compliance with paragraph (3), the Information Commissioner may, having considered the likely adverse effects of the breach, require it to do so.
(8) Service providers shall maintain an inventory of personal data breaches comprising —
(a)the facts surrounding the breach,
(b)the effects of that breach, and
(c)remedial action taken
which shall be sufficient to enable the Information Commissioner to verify compliance with the provisions of this regulation. The inventory shall only include information necessary for this purpose.
[F2(9) This regulation does not apply in relation to any personal data breach which is to be notified to the Investigatory Powers Commissioner in accordance with a code of practice made under the Investigatory Powers Act 2016.]]
Textual Amendments
F1Regs. 5A-5C inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 5
F2Reg. 5A(9) inserted (27.6.2018) by Investigatory Powers Act 2016 (c. 25), s. 272(1), Sch. 10 para. 14 (with Sch. 9 paras. 7, 8, 10); S.I. 2018/652, reg. 12(g)(iii)
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: