[360] 25 (3) A notification shall be made under paragraph (1) as soon as practicable after an incident occurs and, in any event, shall be made not later than 72 hours after the relevant digital service provider becomes aware of the occurrence of the incident. (4) In determining whether to notify an incident under paragraph (1), a relevant digital service provider shall— (a) shall take into account the following in accordance with the Implementing Regulation: (i) the number of users affected by the disruption of the essential service; (ii) the duration of the incident; (iii) the geographical spread of the area affected by the incident; (iv) the extent of the disruption of the functioning of the service; (v) the extent of the impact of the incident on economic and societal activities, and (b) assess whether a situation referred to in Article 4 of the Implementing Regulation has occurred. (5) A notification under this Regulation shall include— (i) the name of the relevant digital service provider, (ii) details of when the incident occurred, (iii) the duration of the incident, (iv) sufficient information to enable the CSIRT to determine whether the incident has any impact on another member state, and, if so, its significance, and (v) any other information which may be of benefit to the CSIRT. (6) The CSIRT shall as soon as possible furnish a copy of a notification made to it under paragraph (1) to the single point of contact and the competent authority. (7) Where appropriate, and in particular if an incident referred to in paragraph (1) concerns another member state, the competent authority or the CSIRT shall notify the single point of contact in the other affected member state of the incident.

Select target paragraph3

Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents