<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["611/2013 — Implementing act — Notification of personal data breaches [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii","url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii","title":"ANNEX II","family":"l2_unit_view","work_id":"spaces/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches","view_of":"/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Regulation (EU) No 611/2013, OJ L 173, 26.6.2013","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2013/611/oj/eng","valid_from":"2013-08-25","valid_until":null,"content_id":"795ee2fa6880683a","versions":["2013-08-25"],"version_url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii/versions/2026-10-26/rev/795ee2fa6880683a","versions_url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii/versions","relations_url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-ii/relations","act_url":"https://www.headlesslaw.com/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches#annex-ii","source_line":"Commission Regulation (EU) No 611/2013 · binding · OJ L 173, 26.6.2013 · dated 24 Jun 2013 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2013-06-24","entry_into_force":"2013-08-25","locators":{"document_date":"CELLAR 32013R0611 work_date_document","entry_into_force":"CELLAR 32013R0611 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches","path":"/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches","name":"Commission Regulation (EU) No 611/2013","number":"611/2013","celex":"32013R0611","title_official":"COMMISSION REGULATION (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications","document_date":"2013-06-24"},"position":{"kind":"annex","key":"annex-ii","index":2,"articles":7,"annexes":2},"prev":{"path":"/eprivacy/level-2/implementing-acts/611-2013-notification-of-personal-data-breaches/annexes/annex-i","key":"annex-i","title":"ANNEX I"},"next":null,"act_anchor":"#annex-ii"}}} -->
# ANNEX II

**Commission Regulation (EU) No 611/2013 · binding · OJ L 173, 26.6.2013 · dated 24 Jun 2013 [in force]**

*In force · Commission Regulation (EU) No 611/2013, OJ L 173, 26.6.2013 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2013/611/oj/eng)*

<a id="annex-ii"></a>Content of the notification to the subscriber or individual

1.

Name of the provider

2.

Identity and contact details of the data protection officer or other contact point where more information can be obtained

3.

Summary of the incident that caused the personal data breach

4.

Estimated date of the incident

5.

Nature and content of the personal data concerned as referred to in Article 3(2)

6.

Likely consequences of the personal data breach for the subscriber or individual concerned as referred to in Article 3(2)

7.

Circumstances of the personal data breach as referred to in Article 3(2)

8.

Measures taken by the provider to address the personal data breach

9.

Measures recommended by the provider to mitigate possible adverse effects