2.

Member States shall ensure that providers of public electronic communications networks or of publicly available electronic communications services notify without undue delay the competent authority of a security incident that has had a significant impact on the operation of networks or services. In order to determine the significance of the impact of a security incident, where available the following parameters shall, in particular, be taken into account: the number of users affected by the security incident; the duration of the security incident; the geographical spread of the area affected by the security incident; the extent to which the functioning of the network or service is affected; the extent of impact on economic and societal activities. Where appropriate, the competent authority concerned shall inform the competent authorities in other Member States and ENISA. The competent authority concerned may inform the public or require the providers to do so, where it determines that disclosure of the security incident is in the public interest. Once a year, the competent authority concerned shall submit a summary report to the Commission and to ENISA on the notifications received and the action taken in accordance with this paragraph.

← art_40__para_1__text_1 · All articles · art_40__para_2__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-28 · Text as adopted (Official Journal); later amendments are not incorporated in this text.