Provides telecom services, in the European Union

Directive 2002/58/EC, Art. 4(3)-(5) · Read the law's page

• This Directive is addressed to the Member States (Article 21), which had to adopt and publish the measures necessary to comply with Directive 2009/136/EC, the amending Directive that added the breach notification paragraphs to Article 4, by 25 May 2011 (Article 4(1) of that Directive), so a provider meets these rules through each Member State's national law.
• If you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)).
• Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)).
• You need not notify the subscriber or individual if you have demonstrated to the satisfaction of the competent authority that you implemented appropriate technological protection measures, that those measures were applied to the data concerned by the breach, and that they render the data unintelligible to any person who is not authorized to access it (Article 4(3)).
• In the notification to the subscriber or individual, describe the nature of the breach and the contact points where more information can be obtained, and recommend measures to mitigate its possible adverse effects; in the notification to the competent national authority, also describe the consequences of the breach and the measures you propose or have taken to address it (Article 4(3)).
• Maintain an inventory of personal data breaches comprising the facts surrounding each breach, its effects and the remedial action taken, sufficient to enable the competent national authorities to verify compliance with the notification duty, and include in it only the information necessary for that purpose (Article 4(4)).

Regulation (EU) No 611/2013 · Read the law's page

• If you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)).
• Where all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)).
• If you cannot provide all the information within the three-day period, notify as much as you have within it, submit to the competent national authority a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible (Article 2(3)).
• Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach, in addition to notifying the competent national authority (Article 3(1)).
• Assess whether the breach is likely to adversely affect a subscriber or individual by taking account of, in particular, the nature and content of the personal data (financial information, special categories of data referred to in Article 8(1) of Directive 95/46/EC, location data, internet log files, web browsing histories, e-mail data and itemized call lists), the likely consequences for the person (identity theft or fraud, physical harm, psychological distress, humiliation or damage to reputation), and the circumstances of the breach, in particular where the data has been stolen or you know it is in the possession of an unauthorized third party (Article 3(2)).
• Notify the subscriber or individual without undue delay after detection of the breach, whether or not you have yet notified the competent national authority (Article 3(3)).
• Include in the notification to the subscriber or individual the information set out in Annex II, express it in clear and easily understandable language, and do not use it as an opportunity to promote or advertise new or additional services (Article 3(4)).
• Notify the subscriber or individual by means of communication that ensure prompt receipt of information and that are appropriately secured according to the state of the art, and keep the information about the breach dedicated to the breach and not associated with information about another topic (Article 3(6)).
• In exceptional circumstances, where notifying the subscriber or individual may put at risk the proper investigation of the breach, you may delay that notification, after obtaining the agreement of the competent national authority, until the authority deems it possible to notify (Article 3(5)).
• If you have a direct contractual relationship with the end user and, despite reasonable efforts, cannot identify within the timeframe all the individuals likely to be adversely affected, you may notify them through advertisements in major national or regional media in the relevant Member States within that timeframe, containing the Annex II information where necessary in a condensed form, and you must continue all reasonable efforts to identify and notify them as soon as possible (Article 3(7)).
• You need not notify the subscriber or individual if you have demonstrated to the satisfaction of the competent national authority that you implemented appropriate technological protection measures, applied to the data concerned by the breach, that render the data unintelligible to any person who is not authorized to access it; data is unintelligible if it has been securely encrypted with a standardized algorithm, or replaced by its hashed value calculated with a standardized cryptographic keyed hash function, and the key has not been compromised in any security breach and cannot be ascertained by available technological means by any person who is not authorized to access the key (Article 4(1) and (2)).
• If you are contracted to deliver part of the electronic communications service without a direct contractual relationship with subscribers, immediately inform the contracting provider in the case of a personal data breach (Article 5).

Directive (EU) 2018/1972, Art. 115 and Annex VI, Part B, point (a) · Read the law's page

• This Directive is addressed to the Member States (Article 127), which had to adopt and publish the measures necessary to comply with it by 21 December 2020 and apply them from 21 December 2020 (Article 124(1)), so a provider meets these rules through each Member State's transposing law.
• It reaches you if you provide an internet access service or a publicly available number-based interpersonal communications service, meaning an interpersonal communications service that connects with publicly assigned numbering resources or enables communication with a number in a national or international numbering plan (Article 2, point (6), and Article 115(1)): where the competent authority of the Member State requires it, make calling-line identification available free of charge, subject to technical feasibility, so that the calling party's number is presented to the called party prior to the call being established (Article 115(1) and Annex VI, Part B, point (a)).
• Where you make calling-line identification available, provide it in accordance with the relevant law on protection of personal data and privacy, in particular Directive 2002/58/EC, and, to the extent technically feasible, provide data and signals to facilitate the offering of calling-line identity and tone dialling across Member State boundaries (Annex VI, Part B, point (a)).

Directive (EU) 2019/882, Arts. 2(2) and 13, Annex I Sections III and IV · Read the law's page

• This duty reaches you through the law of each Member State that transposes the Directive, where you provide, or offer to provide, to consumers in the Union after 28 June 2025 an electronic communications service (other than a transmission service used for machine-to-machine services), a service providing access to audiovisual media services, the website, mobile application, electronic ticketing, travel-information or interactive self-service terminal elements of air, bus, rail or waterborne passenger transport services (for urban, suburban and regional transport services, only the interactive self-service terminals), a consumer banking service, e-books and dedicated software, or an e-commerce service (Article 2(2), Article 3(4)). A microenterprise providing services is exempt from the requirements of Article 4(3) and from any obligations relating to compliance with them (Article 4(5)); Article 3(23) defines a microenterprise as an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million.
• Design and provide your service in accordance with the accessibility requirements of the Directive (Article 13(1)): unless it is an urban, suburban or regional transport service it must meet Section III of Annex I, and every service must meet the part of Section IV of Annex I that applies to it (Article 4(3)).
• Unless your service is an urban, suburban or regional transport service, make your websites, including the related online applications, and your mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Annex I, Section III, point (c)).
• Unless your service is an urban, suburban or regional transport service, make sure the products you use to provide it meet the accessibility requirements of Section I and, where applicable, Section II of Annex I (Annex I, Section III, point (a)).
• Unless your service is an urban, suburban or regional transport service, give information about how it works, and about the accessibility characteristics of any products used in it and their interoperability with assistive devices and facilities, through more than one sensory channel, in an understandable way and in ways users can perceive, in text formats that can be used to generate alternative assistive formats, in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing between letters, lines and paragraphs, with an alternative presentation of any non-textual content, and provide the electronic information needed to provide the service in a consistent and adequate way by making it perceivable, operable, understandable and robust (Annex I, Section III, point (b)).
• Unless your service is an urban, suburban or regional transport service, where you provide support services such as help desks, call centers, technical support, relay services and training services, have them give information on the accessibility of the service and its compatibility with assistive technologies, in accessible modes of communication (Annex I, Section III, point (d)).
• If you offer e-commerce services, provide the information concerning accessibility of the products and services being sold when the responsible economic operator provides it, make the functionality for identification, security and payment perceivable, operable, understandable and robust when it is delivered as part of a service instead of a product, and provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust (Annex I, Section IV, point (g)).
• If you provide consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and ensure that the information is understandable without exceeding a level of complexity superior to level B2 (upper intermediate) of the Council of Europe's Common European Framework of Reference for Languages (Annex I, Section IV, point (e)).
• If you provide an electronic communications service, provide real time text in addition to voice communication, provide total conversation where video is provided in addition to voice, and ensure that emergency communications using voice and text, and video where provided, are synchronized and transmitted to the most appropriate public safety answering point (Annex I, Section IV, point (a)).
• If you provide services giving access to audiovisual media services, provide electronic program guides that are perceivable, operable, understandable and robust and give information about the availability of accessibility, and ensure that subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation are fully transmitted with adequate quality, synchronized with sound and video, with user control of their display and use (Annex I, Section IV, point (b)).
• If you provide e-books or dedicated software, provide synchronized text and audio where an e-book contains audio in addition to text, keep e-book digital files from preventing assistive technology from operating properly, give access to the content, the navigation of the file content and layout including dynamic layout, with structure, flexibility and choice in the presentation of the content, allow alternative renditions interoperable with a variety of assistive technologies, make the e-books discoverable through metadata about their accessibility features, and do not let digital rights management measures block accessibility features (Annex I, Section IV, point (f)).
• If you provide air, bus, rail or waterborne passenger transport services, other than urban, suburban and regional transport services, provide information on the accessibility of vehicles, the surrounding infrastructure and the built environment and on assistance for persons with disabilities, and information about smart ticketing, real-time travel information and additional service information (Annex I, Section IV, point (c)). For urban, suburban and regional transport services, make the self-service terminals used in the service accessible under Section I of Annex I (Annex I, Section IV, point (d)).
• Include in your general terms and conditions, or an equivalent document, the information assessing how the service meets the accessibility requirements, with a general description of the service in accessible formats, the descriptions and explanations needed to understand its operation, and a description of how the relevant requirements of Annex I are met; make that information available to the public in written and oral format, including in a manner accessible to persons with disabilities, and keep it for as long as the service is in operation; and provide information demonstrating that the service delivery process and its monitoring ensure compliance (Article 13(2), Annex V, points 1 and 3).
• Have procedures in place so that the provision of your service remains in conformity, and take adequate account of changes in the characteristics of the service, in the applicable accessibility requirements and in the harmonized standards or technical specifications by reference to which the service is declared to meet them (Article 13(3)).
• If your service does not conform, take the corrective measures necessary to bring it into conformity and immediately inform the competent national authorities of the Member States in which the service is provided, giving details of the non-compliance and of the corrective measures taken (Article 13(4)). On a reasoned request from a competent authority, provide all the information necessary to demonstrate conformity and cooperate on any action taken to bring the service into compliance (Article 13(5)).
• You may rely on fundamental alteration or disproportionate burden only to the extent that compliance would require a significant change that results in the fundamental alteration of the basic nature of the service or would impose a disproportionate burden. Carry out an assessment of either ground, judging disproportionate burden against the criteria in Annex VI, document it, keep all relevant results for five years from the day the service was last provided, give a copy of the assessment to the authorities responsible for checking compliance of services on request, and send information that you rely on this ground to those authorities of the Member State where the service is provided (Article 14(1), (2), (3) and (8)). If you rely on disproportionate burden, renew that assessment for each category or type of service when the service is altered, when those authorities ask, and in any event at least every five years (Article 14(5)). You cannot rely on disproportionate burden where you receive funding, public or private, from other sources than your own resources that is provided for the purpose of improving accessibility (Article 14(6)).
• The Directive does not apply to the following content of websites and mobile applications: pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services if essential information is provided in an accessible digital manner for maps intended for navigational use, third-party content that is neither funded, developed by, or under the control of the economic operator concerned, and archives that only contain content not updated or edited after 28 June 2025 (Article 2(4)).
• Member States provide for a transitional period ending on 28 June 2030 during which you may continue to provide your service using products you lawfully used to provide similar services before that date, and service contracts agreed before 28 June 2025 may continue without alteration until they expire, but no longer than five years from that date; a Member State may also let you keep using self-service terminals you lawfully used to provide services before 28 June 2025 until the end of their economically useful life, but no longer than 20 years after their entry into use (Article 32(1) and (2)).
• If you provide air, bus, rail or waterborne passenger transport services, a service that complies with the requirements on accessible information and on information on accessibility of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011 is deemed to comply with the corresponding requirements of the Directive, and the Directive's additional requirements apply in full (Article 5).

Regulation (EU) 2026/1881 · Read the law's page

• Regulation (EU) 2026/1881 entered into force on the third day after its publication on 28 July 2026, which is 31 July 2026, and applies until 3 April 2028 (Article 11). It reaches you if you are a provider of a number-independent interpersonal communications service (Article 2, point (1)) and you choose to use specific technologies to detect online child sexual abuse on your service, report it and remove online child sexual abuse material from your service (Article 1(1)).
• You may process personal and other data in connection with the service without Article 5(1) and Article 6(1) of Directive 2002/58/EC applying to the confidentiality of the communications only where every condition of Article 3(1) is met. The Regulation does not apply to the scanning of audio communications (Article 1(2)) or to interpersonal communications to which end-to-end encryption is, has been or will be applied (Article 1(3), Article 3(1), point (a)(ii)).
• Limit the processing to what is strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organizations acting in the public interest against child sexual abuse, and of detecting solicitation of children and reporting it, keep it proportionate and limited to the technologies you use for those purposes, and limit it to the content data and related traffic data that are strictly necessary (Article 3(1), point (a)).
• Use technologies that are in accordance with the state of the art in the industry and the least privacy-intrusive, including with regard to data protection by design and by default, and that, to the extent they scan text in communications, are not able to deduce the substance of the content of the communications but are solely able to detect patterns which point to possible online child sexual abuse (Article 3(1), point (b)).
• Use technologies that are sufficiently reliable in that they limit to the maximum extent possible the rate of errors in detecting content representing online child sexual abuse and, where occasional errors occur, rectify their consequences without delay (Article 3(1), point (e)). Limit the technologies you use to detect patterns of possible solicitation of children to relevant key indicators and objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication, without prejudice to the right to human review (Article 3(1), point (f)).
• Conduct a prior data protection impact assessment and a prior consultation procedure under Articles 35 and 36 of Regulation (EU) 2016/679 for any specific technology you use for these purposes (Article 3(1), point (c)). Until 1 April 2027 this does not apply to a provider that was using a specific technology before 31 July 2026 without having completed a prior consultation procedure, starts one before 1 September 2026 and duly cooperates with the competent supervisory authority (Article 3(2)).
• For new technology, meaning technology used to detect online child sexual abuse material that no provider had used in relation to services provided to users in the Union before 31 July 2026, and for technology used to identify possible solicitation of children, report back to the competent authority on the measures you have taken to demonstrate compliance with the written advice the supervisory authority issued under Article 36(2) of Regulation (EU) 2016/679 in the prior consultation (Article 3(1), point (d)). Until 1 April 2027 that condition does not apply to a provider that was using such a technology before 31 July 2026 without having completed a prior consultation procedure for it, starts a procedure as referred to in point (d) before 1 September 2026 and duly cooperates with the competent supervisory authority (Article 3(3)).
• Establish internal procedures to prevent abuse of, unauthorized access to and unauthorized transfers of personal and other data, and ensure human oversight of and, where necessary, human intervention in the processing (Article 3(1), point (g)(i) and (ii)). Do not report material not previously identified as online child sexual abuse material, or solicitation of children, to law enforcement authorities or to organizations acting in the public interest against child sexual abuse without prior human confirmation (Article 3(1), point (g)(iii)).
• Establish procedures and redress mechanisms that let users lodge complaints with you within a reasonable timeframe to present their views (Article 3(1), point (g)(iv)). Inform users in a clear, prominent and comprehensible way that you have invoked the derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC solely for these purposes, of the logic behind the measures you have taken and of the impact on the confidentiality of users' communications, including the possibility that personal data are shared with law enforcement authorities and organizations acting in the public interest against child sexual abuse (Article 3(1), point (g)(v)). Where a user's content has been removed, an account blocked or a service suspended, inform the user of the avenues for seeking redress from you, the possibility of lodging a complaint with a supervisory authority and the right to a judicial remedy (Article 3(1), point (g)(vi)).
• By 1 February 2027 and by 31 January every year thereafter, publish and submit to the competent supervisory authority and to the Commission a report on the processing of personal data under the Regulation, with the content Article 3(1), point (g)(vii), lists, provided in writing by means of the standard form the Commission determines by implementing act (the closing subparagraph of Article 3).
• Store the content data and related traffic data processed for these purposes, and the personal data generated through that processing, in a secure manner and solely for the purposes Article 3(1), point (h), lists once suspected online child sexual abuse has been identified, and no longer than strictly necessary for those purposes and in any event no longer than 12 months from the date of the identification of the suspected online child sexual abuse (Article 3(1), points (h) and (i)).
• Report every case of a reasoned and verified suspicion of online child sexual abuse without delay to the competent national law enforcement authorities or to organizations acting in the public interest against child sexual abuse (Article 3(1), point (j)). By 1 September 2026, communicate to the Commission a list of the names of the organizations to which you report under the Regulation, and communicate changes to that list to the Commission on a regular basis (Article 7(1)).

Regulation (EU) No 910/2014, Article 5f(2) · Read the law's page

• This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than 24 December 2027, 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on 24 December 2024.
• Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).