art_32__para_7

7. When taking any of the enforcement measures referred to in paragraph 4 or 5, the competent authorities shall comply with the rights of the defence and take account of the circumstances of each individual case and, as a minimum, take due account of: the seriousness of the infringement and the importance of the provisions breached, the following, inter alia, constituting serious infringement in any event: repeated violations; a failure to notify or remedy significant incidents; a failure to remedy deficiencies following binding instructions from competent authorities; the obstruction of audits or monitoring activities ordered by the competent authority following the finding of an infringement; providing false or grossly inaccurate information in relation to cybersecurity risk-management measures or reporting obligations laid down in Articles 21 and 23; the duration of the infringement; any relevant previous infringements by the entity concerned; any material or non-material damage caused, including any financial or economic loss, effects on other services and the number of users affected; any intent or negligence on the part of the perpetrator of the infringement; any measures taken by the entity to prevent or mitigate the material or non-material damage; any adherence to approved codes of conduct or approved certification mechanisms; the level of cooperation of the natural or legal persons held responsible with the competent authorities.

← art_32__para_6__para · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.