ANNEX I

Content of the notification to the competent national authority

Section 1

Identification of the provider

Name of the provider

Identity and contact details of the data protection officer or other contact point where more information can be obtained

Whether it concerns a first or second notification

Initial information on the personal data breach (for completion in later notifications, where applicable)

Date and time of incident (if known; where necessary an estimate can be made), and of detection of incident

Circumstances of the personal data breach (e.g. loss, theft, copying)

Nature and content of the personal data concerned

Technical and organisational measures applied (or to be applied) by the provider to the affected personal data

Relevant use of other providers (where applicable)

Section 2

Further information on the personal data breach

Summary of the incident that caused the personal data breach (including the physical location of the breach and the storage media involved):

Number of subscribers or individuals concerned

Potential consequences and potential adverse effects on subscribers or individuals

Technical and organisational measures taken by the provider to mitigate potential adverse effects

Possible additional notification to subscribers or individuals

Content of notification

Means of communication used

Number of subscribers or individuals notified

Possible cross-border issues

Personal data breach involving subscribers or individuals in other Member States

Notification of other competent national authorities