# ANNEX I **Commission Regulation (EU) No 611/2013 · binding · OJ L 173, 26.6.2013 · dated 24 Jun 2013 [in force]** *In force · Commission Regulation (EU) No 611/2013, OJ L 173, 26.6.2013 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2013/611/oj/eng)* Content of the notification to the competent national authority Section 1 Identification of the provider 1. Name of the provider 2. Identity and contact details of the data protection officer or other contact point where more information can be obtained 3. Whether it concerns a first or second notification Initial information on the personal data breach (for completion in later notifications, where applicable) 4. Date and time of incident (if known; where necessary an estimate can be made), and of detection of incident 5. Circumstances of the personal data breach (e.g. loss, theft, copying) 6. Nature and content of the personal data concerned 7. Technical and organisational measures applied (or to be applied) by the provider to the affected personal data 8. Relevant use of other providers (where applicable) Section 2 Further information on the personal data breach 9. Summary of the incident that caused the personal data breach (including the physical location of the breach and the storage media involved): 10. Number of subscribers or individuals concerned 11. Potential consequences and potential adverse effects on subscribers or individuals 12. Technical and organisational measures taken by the provider to mitigate potential adverse effects Possible additional notification to subscribers or individuals 13. Content of notification 14. Means of communication used 15. Number of subscribers or individuals notified Possible cross-border issues 16. Personal data breach involving subscribers or individuals in other Member States 17. Notification of other competent national authorities