### 5. the commission shall communicate its objections to the gatekeeper concerned within six months from the opening of the investigation. in its objections , the commission shall explain whether it preliminarily considers that the conditions of paragraph 1 are met and which remedy or remedies it preliminarily considers necessary and proportionate. ### 5. the commission shall communicate its objections to the gatekeeper concerned within three months from the opening of the investigation. in its objections , the commission shall explain whether it preliminarily considers that the conditions of paragraph 1 are met and which remedy or remedies it preliminarily considers necessary and proportionate.


### 1. in case of urgency due to the risk of serious and irreparable damage for business users or end users of gatekeepers , the commission may , by decision adopt in accordance with the advisory procedure referred to in article 32(4) , order interim measures against a gatekeeper on the basis of a prima facie finding of an infringement of articles 5 or 6. ### 1. in case of urgency due to the risk of serious and irreparable damage for business users or end users of gatekeepers imminent threats to the fairness and contestability of markets or the general considerations laid out in article 1(1) , the commission may , by decision adopt in accordance with the advisory procedure referred to in article 32(4) , order interim measures against a gatekeeper.


### 1. in case of urgency due to the risk of serious and irreparable damage for business users or end users of gatekeepers , the commission may , by decision adopt in accordance with the advisory procedure referred to in article 32(4) , order interim measures against a gatekeeper on the basis of a prima facie finding of an infringement of articles 5 or 6. ### 1. in case of urgency due to the risk of serious and irreparable damage for business users or end users of gatekeepers , imminent threats to the fairness and contestability of markets or the general considerations laid out in article 1(1) , the commission may , by decision adopt in accordance with the advisory procedure referred to in article32(4) , order interim measures against a gatekeeper.


### 2. the actions pursuant to paragraph 1 may include the appointment of independent external experts and auditors to assist the commission to monitor the obligations and measures and to provide specific expertise or knowledge to the commission. ### 2. the commission will ensure that the number of permanent staff exclusively allocated for activities pertaining to the implementation of this regulation is no lower than 300. the actions pursuant to paragraph 1 may include the appointment of independent external experts and auditors to assist the commission to monitor the obligations and measures and to provide specific expertise or knowledge to the commission.


### 2. member states shall submit evidence in support of their request. ### 2. member states shall submit evidence in support of their request. such evidence provided by competent national authorities shall in particular notably include information allowing to determine the fairness of general access conditions to core platform services , including as regards revenue streams deriving from advertisement , and the distribution of appropriate shares of revenues to third party rightholders.


### 2. member states shall submit evidence in support of their request. ### 2. member states shall submit evidence in support of their request. such evidence provided by competent national authorities shall notably include information allowing to determine the fairness of general access conditions to core platform services , including as regards revenue streams deriving from advertisement , and the distribution of appropriate shares of revenues to third party right holders.


### 1. the commission may adopt implementing acts concerning: 3 , 6 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30 ### 1. the commission may adopt implementing acts concerning: 3 , 6 , 7 , 12 , 13 , 15 , 16 , 17 , 20 , 22 , 23 , 25 and 30


### 2. the practical arrangements for the cooperation and coordination between the commission and member states provided for in article 1(7).those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 32(4). before the adoption of any measures pursuant to paragraph 1 , the commission shall publish a draft thereof and invite all interested parties to submit their comments within the time limit it lays down , which may not be less than one month. ### 2. the practical arrangements for the cooperation and coordination between the commission and member states provided for in article 1(7).those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 32(4). before the adoption of any measures pursuant to paragraph 1 , the commission shall publish a draft thereof and invite all interested parties , including end user representatives and civil society , to submit their comments within the time limit it lays down , which may not be less than one month.


### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should not be designated directly , but only subject to a further investigation. the burden of adducing evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission. ### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should be subject to an assessment by the commission whether they qualify or not as a gatekeeper in light of the argument presented. this assessment should be done within specific time-limits and not lead to undue delay in designating the provider of a core platform service as a gatekeeper. the burden of adducing evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider. in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission.


### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should not be designated directly , but only subject to a further investigation. the burden of adducing evidence that the presumption deriving from the fulfilment of quantitative thresholds should not apply to a specific provider should be borne by that provider in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission. ### (23) providers of core platform services which meet the quantitative thresholds but are able to present sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , they do not fulfil the objective requirements for a gatekeeper , should be subject to an assessment by the commission whether they qualify or not as a gatekeeper in light of the argument presented. this assessment should be done within specific time limits and not lead to undue delay in designating the provider of a core platform service as a gatekeeper. in its assessment , the commission should take into account only the elements which directly relate to the requirements for constituting a gatekeeper , namely whether it is an important gateway which is operated by a provider with a significant impact in the internal market with an entrenched and durable position , either actual or foreseeable. any justification on economic grounds seeking to demonstrate efficiencies deriving from a specific type of behaviour by the provider of core platform services should be discarded , as it is not relevant to the designation as a gatekeeper. the commission should be able to take a decision by relying on the quantitative thresholds where the provider significantly obstructs the investigation by failing to comply with the investigative measures taken by the commission.


### (64) the commission should investigate and assess whether additional behavioural , or , where appropriate , structural remedies are justified , in order to ensure that the gatekeeper cannot frustrate the objectives of this regulation by systematic non-compliance with one or several of the obligations laid down in this regulation , which has further strengthened its gatekeeper position. this would be the case if the gatekeeper’s size in the internal market has further increased , economic dependency of business users and end users on the gatekeeper’s core platform services has further strengthened as their number has further increased and the gatekeeper benefits from increased entrenchment of its position. the commission should therefore in such cases have the power to impose any remedy , whether behavioural or structural , having due regard to the principle of proportionality. structural remedies , such as legal , functional or structural separation , including the divestiture of a business , or parts of it , should only be imposed either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the undertaking concerned than the structural remedy. changes to the structure of an undertaking as it existed before the systematic non-compliance was established would only be proportionate where there is a substantial risk that this systematic non-compliance results from the very structure of the undertaking concerned. ### (64) the commission should investigate and assess whether additional behavioural , or , where appropriate , structural remedies are justified , in order to ensure that the gatekeeper cannot frustrate the objectives of this regulation by systematic non-compliance with one or several of the obligations laid down in this regulation. in imposing these remedies , the commission should take into consideration if the gatekeeper’s size in the internal market has further increased , economic dependency of business users and end users on the gatekeeper’s core platform services has further strengthened as their number has further increased and the gatekeeper benefits from increased entrenchment of its position. the commission should therefore in such cases have the power to impose any remedy , whether behavioural or structural , having due regard to the principle of proportionality. structural remedies , such as legal , functional or structural separation , including the divestiture of a business , or parts of it , should only be imposed either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the undertaking concerned than the structural remedy. changes to the structure of an undertaking as it existed before the systematic non-compliance was established would only be proportionate where there is a substantial risk that this systematic non-compliance results from the very structure of the undertaking concerned.


### (59) as an additional element to ensure proportionality , gatekeepers should be given an opportunity to request the suspension , to the extent necessary , of a specific obligation in exceptional circumstances that lie beyond the control of the gatekeeper , such as for example an unforeseen external shock that has temporarily eliminated a significant part of end user demand for the relevant core platform service , where compliance with a specific obligation is shown by the gatekeeper to endanger the economic viability of the union operations of the gatekeeper concerned. ### (59) as an additional element to ensure proportionality , gatekeepers should be given an opportunity to request the temporary suspension , to the extent necessary , of a specific obligation in exceptional circumstances that lie beyond the control of the gatekeeper , such as for example an unforeseen external shock that has temporarily eliminated a significant part of end user demand for the relevant core platform service , where compliance with a specific obligation is shown by the gatekeeper to endanger the economic viability of the union operations of the gatekeeper concerned. the commission should state in its decision the reasons for granting the suspension and review it on a regular basis to assess if the conditions for granting it are still viable or not.


### (68) in order to ensure effective implementation and compliance with this regulation , the commission should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation. ### (68) in order to ensure effective implementation and compliance with this regulation , the commission should have strong investigative and enforcement powers , to allow it to investigate , enforce and monitor the rules laid down in this regulation , while at the same time ensuring the respect for the fundamental right to be heard and to have access to the file in the context of the enforcement proceedings. the commission should dispose of these investigative powers also for the purpose of carrying out market investigations for the purpose of updating and reviewing this regulation. national competent authorities should assist the commission in monitoring and enforcing obligations laid down in this regulation by providing support and expertise to the commission or by requesting the commission to open a market investigation based on evidence collected.


### 2. the commission may only impose structural remedies pursuant to paragraph 1 either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the gatekeeper concerned than the structural remedy. ### 2. the commission may only impose structural remedies pursuant to paragraph 1 either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the gatekeeper concerned than the structural remedy. such structural remedies may include:


### 2. the commission may only impose structural remedies pursuant to paragraph 1 either where there is no equally effective behavioural remedy or where any equally effective behavioural remedy would be more burdensome for the gatekeeper concerned than the structural remedy. ### 2. the commission may also impose structural remedies pursuant to paragraph 1 where it considers it more effective than behavioural remedies in ensuring compliance with the obligations laid down in articles 5 and 6. such structural remedies may include:


### 4. a gatekeeper shall be deemed to have further strengthened or extended its gatekeeper position in relation to the characteristics under article 3(1) , where its impact on the internal market has further increased , its importance as a gateway for business users to reach end users has further increased or the gatekeeper enjoys a further entrenched and durable position in its operations. ### deleted


### 2. a decision pursuant to paragraph 1 may only be adopted in the context of proceedings opened in view of the possible adoption of a decision of non-compliance pursuant to article 25(1). this decision shall apply for a specified period of time and may be renewed in so far this is necessary and appropriate. ### 2. this decision shall apply for a specified period of time and may be renewed in so far this is necessary and appropriate.


### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. ### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. in case the non-compliance persists following a review of the measures proposed by the gatekeeper , the commission shall propose amendments to these measures to ensure full compliance with the obligations laid down in articles 5 and 6.


### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. ### 4. the gatekeeper shall provide the commission with the description of the measures it took to ensure compliance with the decision adopted pursuant to paragraph 1. in case the noncompliance persists following a review of the measures taken by the gatekeeper , the commission shall propose amendments to these measures to ensure full compliance with obligations laid down under articles 5 and 6.


### 1. the information collected pursuant to articles 3 , 12 , 13 , 19 , 20 and 21 shall be used only for the purposes of this regulation. ### 1. the information collected pursuant to articles 3 , 19 , 20 and 21 shall be used only for the purposes of this regulation.


### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32. ### 2. without prejudice to the exchange and to the use of information provided for the purpose of use pursuant to articles 12 , 13 , 32 and 33 , the commission , the authorities of the member states , their officials , servants and other persons working under the supervision of these authorities and any natural or legal person , including auditors and experts appointed pursuant to article 24(2) , shall not disclose information acquired or exchanged by them pursuant to this regulation and of the kind covered by the obligation of professional secrecy. this obligation shall also apply to all representatives and experts of member states participating in any of the activities of the digital markets advisory committee pursuant to article 32.


### cloud computing services; ### cloud computing services including business to business cloud;


### 4. the commission shall , without undue delay and at the latest 60 days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , and taking into account the elements listed in paragraph 6 , the provider does not satisfy the requirements of paragraph 1. ### 4. the commission shall , without undue delay and at the latest 60 days after receiving the complete information referred to in paragraph 3 , designate the provider of core platform services that meets all the thresholds of paragraph 2 as a gatekeeper , unless that provider , with its notification , presents sufficiently substantiated arguments to demonstrate that , in the circumstances in which the relevant core platform service operates , the provider does not satisfy the requirements of paragraph 1.


### the size , including turnover and market capitalisation , operations and position of the provider of core platform services; ### the size , including turnover and market capitalisation , operations and position of the provider of core platform services , taking into account any intended concentration in line with article 12(1);


### 4. with regard to interpersonal communication services this regulation is without prejudice to the powers and tasks granted to the national regulatory and other competent authorities by virtue of article 61 of directive (eu) 2018/1972. ### 4. with regard to interpersonal communication services this regulation builds on article 61 of directive (eu) 2018/1972 and establishes additional union level obligations for gatekeepers , without prejudice to the powers and tasks granted to the national regulatory and other competent authorities by virtue of that article.


### (9) however , small or micro entities fulfilling certain criteria that indicate a key role for the economies or societies of member states or for particular sectors or types of services , should also be covered by this directive. member states should be responsible for establishing a list of such entities , and submit it to the commission. ### (9) however , small or micro entities , unless fulfilling certain criteria that indicate a key role for the economies or societies of member states or for particular sectors or types of services , should not be covered by this directive. member states should be responsible for establishing a list of such entities , and submit it to the commission. in order not to jeopardise collaborative innovation , non-commercial , free and open source projects should not be covered by this directive.


### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend. therefore , this directive should apply to all providers of dns services along the dns resolution chain , including operators of root name servers , top-level-domain (tld) name servers , authoritative name servers for domain names and recursive resolvers. ### (15) upholding and preserving a reliable , resilient and secure domain name system (dns) is a key factor in maintaining the integrity of the internet and is essential for its continuous and stable operation , on which the digital economy and society depend.


### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. ### (25) csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council , on behalf of and upon specific request by an entity under this directive , a scanning of the network and information systems used for the provision of their services in order to identify , mitigate or prevent specific network and information security threats. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts.


### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. ### (25) member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts.


### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts. ### (25) as regards personal data , csirts should be able to provide , in accordance with regulation (eu) 2016/679 of the european parliament and of the council19 as regards personal data , on behalf of and upon request by an entity under this directive , a proactive scanning of the network and information systems used for the provision of their services in order to identify , mitigate or prevent specific network and information security threats. processing of personal data by such scanning should be kept to the minimum necessary and should , in particular , respect the principles of data minimisation , purpose limitation and data protection by design and by default. member states should aim at ensuring an equal level of technical capabilities for all sectorial csirts. member states may request the assistance of the european union agency for cybersecurity (enisa) in developing national csirts.


### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should establish a vulnerability registry where , essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures. ### (30) access to correct and timely information on vulnerabilities affecting ict products and services contributes to an enhanced cybersecurity risk management. in that regard , sources of publicly available information on vulnerabilities are an important tool for entities and their users , but also national competent authorities and csirts. for this reason , enisa should ensure that essential and important entities and their suppliers , as well as entities which do not fall in the scope of application of this directive may , on a voluntary basis , disclose vulnerabilities and provide the vulnerability information that allows users to take appropriate mitigating measures.


### (31) although similar vulnerability registries or databases do exist , these are hosted and maintained by entities which are not established in the union. a european vulnerability registry maintained by enisa would provide improved transparency regarding the publication process before the vulnerability is officially disclosed , and resilience in cases of disruptions or interruptions on the provision of similar services. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions. ### (31) vulnerability registries or databases are hosted and maintained by entities which are not established in the union. to avoid duplication of efforts and seek complementarity to the extent possible , enisa should enter into structured cooperation agreements with vulnerability registries in third country jurisdictions and it should ensure that reports are transmitted to appropriate registries internationally. enisa should support european companies in their use of such registries.


### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp. ### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp and should favour open source cybersecurity products for both software and hardware , as well as open source implementation of open and state-of-the-art , strong cryptography standards.


### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of cyberattacks themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp. ### (44) among service providers , managed security services providers (mssps) in areas such as incident response , penetration testing , security audits and consultancy play a particularly important role in assisting entities in their efforts to detect and respond to incidents. those mssps have however also been the targets of attacks against information systems themselves and through their close integration in the operations of operators pose a particular cybersecurity risk. entities should therefore exercise increased diligence in selecting an mssp.


### (53) in particular , providers of public electronic communications networks or publicly available electronic communications services , should inform the service recipients of particular and significant cyber threats and of measures they can take to protect the security of their communications , for instance by using specific types of software or encryption technologies. ### (53) strong and state of the art encryption is critical and irreplaceable for effective consistent protection of consumer and business security in the single market. strong and state of the art encryption must be available to be used for mitigation of risks to network and information security. to protect their consumers providers of public electronic communications networks or publicly available electronic communications services , should implement security by design and by default , and inform the service recipients of particular and significant cyber threats and of additional measures they can take to protect the security of their devices and communications , for instance by using specific types of software or encryption technologies.


### (53) in particular , providers of public electronic communications networks or publicly available electronic communications services , should inform the service recipients of particular and significant cyber threats and of measures they can take to protect the security of their communications , for instance by using specific types of software or encryption technologies. ### (53) encryption is critical and irreplaceable for safeguarding the security of electronic communications networks and services data protection and privacy. strong and state of the art encryption must be available to be used for mitigation of risks to network and information security and for the rights and freedoms of individuals. providers of public electronic communications networks or publicly available electronic communications services , should implement security by design and by default , and inform the service recipients of particular and significant cyber threats and of additional measures they can take to protect the security of their devices and communications , for instance by using specific types of software or encryption technologies. the approach to security through obscurity has its limitations , while the open cooperative models can provide relief and increase the security of hardware and software , therefore service providers and traders are encouraged to use open source and open hardware.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption is without prejudice to member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information from end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. any actions taken have to stricly adhere to the principles of necessity , proportionality and subsidiarity and shall not lead to creating backdoors or weakening encryption , ensuring that the security of encrypted data , including in end-to-end encrypted communications is not compromised.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , should be mandatory for providers of such services and networks , in accordance with the principles of security and privacy by default and by design , for the purposes of article 18. the security of end-to-end encryption should not be weakened by member state powers , policies or procedures for ensuring the protection of their essential security interests and public security.


### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and , where necessary , should be mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption should be reconciled with the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. ### (54) in order to safeguard the security of electronic communications networks and services , the use of encryption , and in particular end-to-end encryption , should be promoted and mandatory for providers of such services and networks in accordance with the principles of security and privacy by default and by design for the purposes of article 18. the use of end-to-end encryption is without prejudice to the member state’ powers to ensure the protection of their essential security interests and public security , and to permit the investigation , detection and prosecution of criminal offences in compliance with union law. such enforcement powers must always fully respect due process and other safeguards , as well as fundamental rights , in particular the right to respect for private life and communications and the right to the protection of personal data. solutions for lawful access to information from end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications , while providing an effective response to crime. any actions taken have to carefully adhere to the principles of necessity , proportionality and subsidiarity and shall not lead to creating backdoors or weakening encryption , ensuring that the privacy and security of encrypted data , including in end-to-end encrypted communications is not compromised.


### (59) maintaining accurate and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law. ### (59) maintaining accurate databases of domain names and registration data (‘whois data’) and providing lawful access to competent authorities for network and information security to such data may contribute to increased cybersecurity. where processing includes personal data such processing shall comply with union data protection law.


### (59) maintaining accurate and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to such data is essential to ensure the security , stability and resilience of the dns , which in turn contributes to a high common level of cybersecurity within the union. where processing includes personal data such processing shall comply with union data protection law. ### (59) maintaining accurate and complete databases of domain names and registration data (so called ‘whois data’) and providing lawful access to competent authorities for network and information security to such data may contribute to increased cybersecurity. where processing includes personal data such processing shall comply with union data protection law. this directive is to be applied in full compliance with regulation (eu) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data , and with directive 2002/58/ec on concerning the processing of personal data and the protection of privacy in the electronic communications sector , and is not modifying or adding to their provisions.


### (60) the availability and timely accessibility of these data to public authorities , including competent authorities under union or national law for the prevention , investigation or prosecution of criminal offences , certs , (csirts , and as regards the data of their clients to providers of electronic communications networks and services and providers of cybersecurity technologies and services acting on behalf of those clients , is essential to prevent and combat domain name system abuse , in particular to prevent , detect and respond to cybersecurity incidents. such access should comply with union data protection law insofar as it is related to personal data. ### (60) the availability and timely accessibility of data to public authorities , certs and csirts can sometimes be useful to prevent and combat domain name system abuse , in particular to respond to cybersecurity incidents. such access should comply with union data protection law insofar as it is related to personal data.


### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules. ### (61) in order to ensure the availability of accurate domain name registration data , tld registries and the entities providing domain name registration services for the tld should collect the domain name registration data necessary for the provision of their services. they should also take steps to prevent and correct inaccurate registration data in accordance with union data protection rules.


### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) should collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld should establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules. ### (61) in order to ensure the availability of accurate and complete domain name registration data , tld registries and the entities providing domain name registration services for the tld (so-called registrars) collect and guarantee the integrity and availability of domain names registration data. in particular , tld registries and the entities providing domain name registration services for the tld establish policies and procedures to collect and maintain accurate and complete registration data , as well as to prevent and correct inaccurate registration data in accordance with union data protection rules.


### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board. ### (62) tld registries should also enable lawful access , without undue delay , to competent national authorities , as designated by member states under their national cybersecurity strategies , to specific domain name registration data concerning natural persons , in accordance with union data protection law.


### (62) tld registries and the entities providing domain name registration services for them should make publically available domain name registration data that fall outside the scope of union data protection rules , such as data that concern legal persons25 . tld registries and the entities providing domain name registration services for the tld should also enable lawful access to specific domain name registration data concerning natural persons to legitimate access seekers , in accordance with union data protection law. member states should ensure that tld registries and the entities providing domain name registration services for them should respond without undue delay to requests from legitimate access seekers for the disclosure of domain name registration data. tld registries and the entities providing domain name registration services for them should establish policies and procedures for the publication and disclosure of registration data , including service level agreements to deal with requests for access from legitimate access seekers. the access procedure may also include the use of an interface , portal or other technical tool to provide an efficient system for requesting and accessing registration data. with a view to promoting harmonised practices across the internal market , the commission may adopt guidelines on such procedures without prejudice to the competences of the european data protection board. ### deleted


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , which should be limited to what is strictly necessary and proportionate , for the purposes of ensuring network and information security by public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679.


### (69) the processing of personal data , to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679. that should include measures related to the prevention , detection , analysis and response to incidents , measures to raise awareness in relation to specific cyber threats , exchange of information in the context of vulnerability remediation and coordinated disclosure , as well as the voluntary exchange of information on those incidents , as well as cyber threats and vulnerabilities , indicators of compromise , tactics , techniques and procedures , cybersecurity alerts and configuration tools. such measures may require the processing of the following types of personal data: ip addresses , uniform resources locators (urls) , domain names , and email addresses. ### (69) the processing of personal data , which should be limited to what is strictly necessary and proportionate for the purposes of ensuring network and information security by entities , public authorities , certs , csirts , and providers of security technologies and services should constitute a legitimate interest of the data controller concerned , as referred to in regulation (eu) 2016/679.


### (79) a peer-review mechanism should be introduced , allowing the assessment by experts designated by the member states of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. ### (79) a peer-review mechanism should be introduced , allowing the assessment by independent experts designated by the member states , of the implementation of cybersecurity policies , including the level of member states’ capabilities and available resources. when deciding on the methodology , the commission , supported by enisa , should establish an objective , non-discriminatory , technology neutral , fair and transparent system for the selection of such experts.


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec28 nor to non-commercial free and open source projects.


### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec.28 ### 1. this directive applies to public and private entities of a type referred to as essential entities in annex i and as important entities in annex ii. this directive does not apply to entities that qualify as micro and small enterprises within the meaning of commission recommendation 2003/361/ec28 nor to non-commercial free and open source projects. article 3 paragraph 4 of the annex to commission recommendation 2003/361/ec is not applicable.


### a potential disruption of the service provided by the entity could have an impact on public safety , public security or public health; ### a disruption of the service provided by the entity could have an impact on public safety , public security or public health;


### a potential disruption of the service provided by the entity could induce systemic risks , in particular for the sectors where such disruption could have a cross-border impact; ### a disruption of the service provided by the entity could induce systemic risks , in particular for the sectors where such disruption could have a cross-border impact;


### a policy addressing cybersecurity in the supply chain for ict products and services used by essential and important entities for the provision of their services; ### a policy addressing cybersecurity in the supply chain for ict products and services used by essential and important entities for the provision of their services , which should favour open source cybersecurity products for both software and hardware , as well as open source implementation of open and state-of-the-art , strong cryptography standards;


### guidelines regarding the inclusion and specification of cybersecurity-related requirements for ict products and service in public procurement; ### guidelines regarding the inclusion and specification of cybersecurity-related requirements for ict products and service in public procurement , including the promotion of the use of open source cybersecurity products;


### guidelines regarding the inclusion and specification of cybersecurity-related requirements for ict products and service in public procurement; ### guidelines regarding the inclusion and specification of cybersecurity-related requirements for ict products and service in public procurement , including but not limited to encryption requirements and the promotion of the use of open source cybersecurity products;


### a policy on promoting and developing cybersecurity skills , awareness raising and research and development initiatives; ### a policy on promoting and developing technology neutral cybersecurity skills , awareness raising and research and development initiatives;


### a policy on supporting academic and research institutions to develop cybersecurity tools and secure network infrastructure; ### a policy on supporting education establishments , in particular academic and research institutions to develop and deploy cybersecurity tools and secure network infrastructure;


### coordinated vulnerability disclosure and a european vulnerability registry ### coordinated vulnerability disclosure


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services in relevant international registries.


### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. ### 2. enisa shall develop and maintain a european vulnerability registry. to that end , enisa shall establish and maintain the appropriate information systems , policies and procedures with a view in particular to enabling important and essential entities and their suppliers of network and information systems to disclose and register vulnerabilities present in ict products or ict services , as well as to provide access to the information on vulnerabilities contained in the registry to all interested parties. the registry shall , in particular , include information describing the vulnerability , the affected ict product or ict services and the severity of the vulnerability in terms of the circumstances under which it may be exploited , the availability of related patches and , in the absence of available patches , guidance addressed to users of vulnerable products and services as to how the risks resulting from disclosed vulnerabilities may be mitigated. for ensuring security and accessibility of information , state of the art cybersecurity measures shall be accompanied by machine-readable datasets and corresponding interfaces (apis).


### providing , upon request of an entity , a proactive scanning of the network and information systems used for the provision of their services; ### providing , upon a specific request of an entity , scanning of the network and information systems used for the provision of their services in order to identify , mitigate or prevent specific and exceptional network and information security threats , in compliance with union law;


### providing , upon request of an entity , a proactive scanning of the network and information systems used for the provision of their services; ### providing , upon a specific request of an entity , scanning of the network and information systems used for the provision of their services in order to identify , mitigate or prevent specific and exceptional network and information security threats , in full respect of regulation 2016/679;


### 1. enisa shall issue , in cooperation with the commission , a biennial report on the state of cybersecurity in the union. the report shall in particular include an assessment of the following: ### 1. enisa shall issue , in cooperation with the commission , a biennial report on the state of cybersecurity in the union. the report shall be delivered in machine-readable format and shall in particular include an assessment of the following:


### 2. the methodology shall include objective , non-discriminatory , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review. ### 2. the methodology shall include objective , non-discriminatory , technology-neutral , fair and transparent criteria on the basis of which the member states shall designate experts eligible to carry out the peer reviews. enisa and the commission shall designate experts to participate as observers in the peer-reviews. the commission , supported by enisa , shall establish within the methodology as referred to in paragraph 1 an objective , non-discriminatory , fair and transparent system for the selection and the random allocation of experts for each peer review.


### the use of cryptography and encryption. ### the use of cryptography and strong encryption.


### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### 3. member states shall ensure that , where considering appropriate measures referred to in point (d) of paragraph 2 , entities shall take into account the vulnerabilities specific to each supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. for this purpose they should also favour open source cybersecurity products for both software and hardware , as well as open source implementation of open and state-of-the-art , strong cryptography standards.


### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. where appropriate , those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident. ### 1. member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt in accordance with paragraphs 3 and 4 of any incident having a significant impact on the provision of their services. those entities shall notify , without undue delay , the recipients of their services of incidents that are likely to adversely affect the provision of that service and provide information that would enable them to mitigate the adverse effects of the cyberattacks. by exception , where public disclosure could trigger further cyberattacks , essential and important entities , could delay the notification. member states shall ensure that those entities report , among others , any information enabling the competent authorities or the csirt to determine any cross-border impact of the incident.


### member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that , if steps to mitigate the risk had not been taken or are not taken in the future , would have resulted or are likely in the future to result , in a significant incident.


### member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident. ### member states shall ensure that essential and important entities notify , without undue delay , the competent authorities or the csirt of any significant cyber threat that , if steps to mitigate the risk had not been taken or are not taken in the future , would have resulted or are likely in the future to result in a significant incident.


### 7. where public awareness is necessary to prevent an incident or to deal with an ongoing incident , or where disclosure of the incident is otherwise in the public interest , the competent authority or the csirt , and where appropriate the authorities or the csirts of other member states concerned may , after consulting the entity concerned , inform the public about the incident or require the entity to do so. ### 7. where public awareness is necessary to prevent an incident or to deal with an ongoing incident , or where disclosure of the incident is otherwise in the public interest , the competent authority or the csirt , and where appropriate the authorities or the csirts of other member states concerned shall , after consulting the entity concerned , inform the public about the incident or require the entity to do so.


### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to union data protection law as regards data which are personal data. ### 1. for the purpose of contributing to the security , stability and resilience of the dns , member states shall ensure that tld registries and the entities providing domain name registration services for the tld shall collect and maintain the accurate domain name registration data necessary for the provision of their services , in compliance with union data protection law.


### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds. ### deleted


### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the tlds. ### 2. member states shall ensure that the databases of domain name registration data referred to in paragraph 1 contain relevant the information necessary to identify and contact the holders of the domain names.


### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available. ### deleted


### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate and complete information. member states shall ensure that such policies and procedures are made publicly available. ### 3. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld have policies and procedures in place to ensure that the databases include accurate information.


### 4. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld publish , without undue delay after the registration of a domain name , domain registration data which are not personal data. ### deleted


### 5. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers , in compliance with union data protection law. member states shall ensure that the tld registries and the entities providing domain name registration services for the tld reply without undue delay to all requests for access. member states shall ensure that policies and procedures to disclose such data are made publicly available. ### 5. member states shall ensure that the tld registries provide access to specific domain name registration data upon lawful and duly justified requests of competent national authorities , in compliance with union data protection law. member states shall ensure that the tld reply without undue delay to lawful and duly justified requests for access from competent national authorities.


### 1. enisa shall create and maintain a registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]: ### 1. enisa shall create and maintain a secure registry for essential and important entities referred to in article 24(1). the entities shall submit the following information to enisa by [12 months after entering into force of the directive at the latest]:


### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches. ### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches without prejudice to the competences , tasks , and powers of data protection authorities pursuant to regulation (eu) 2016/679.


### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches. ### 2. competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches , without prejudice to the competences , tasks and powers of data protection authorities pursuant to regulation (eu) 2016/679.


### targeted security audits based on risk assessments or risk-related available information; ### security audits based on risk assessments or risk-related available information , carried out by a qualified independent body or a competent authority or independent experts and make the results thereof available to the competent authority; the cost of the audit shall be paid by the provider;


### targeted security audits based on risk assessments or risk-related available information; ### security audits based on risk assessments or risk-related available information carried out by a qualified independent body or a competent authority or independent experts and make the results thereof available to the competent authority; the cost of the audit shall be paid by the provider;


### targeted security audits based on risk assessments or risk-related available information; ### security audits based on risk assessments or risk-related available information carried out by a qualified independent body or a competent authority and make the results thereof available to the competent authority; the cost of the audit shall be paid by the provider;


### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation within a reasonable period of time. ### 1. where the competent authorities have indications that the infringement by an essential or important entity of the obligations laid down in articles 18 and 20 entails a personal data breach , as defined by article 4(12) of regulation (eu) 2016/679 which shall be notified pursuant to article 33 of that regulation , they shall inform the supervisory authorities competent pursuant to articles 55 and 56 of that regulation within 72 hours.


### 3. where the supervisory authority competent pursuant to regulation (eu) 2016/679 is established in another member state than the competent authority , the competent authority may inform the supervisory authority established in the same member state. ### 3. where the supervisory authority competent pursuant to regulation (eu) 2016/679 is established in another member state than the competent authority , the competent authority shall inform the supervisory authority established in the same member state.


### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network. such agreements should ensure adequate protection of data. ### (36) the union should , where appropriate , conclude international agreements , in accordance with article 218 tfeu , with third countries or international organisations , allowing and organising their participation in some activities of the cooperation group and the csirts network and the european cyber crises liaison organisation network. such agreements should ensure adequate protection of union interests and data. this shall not preclude the right of member states to cooperate with like-minded third countries on management of vulnerabilities and cyber security risk management , facilitating reporting and general information sharing in line with union legislation.


### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to cyber-attacks and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products and cybersecurity practices of their suppliers and service providers , including their secure development procedures. ### (43) addressing cybersecurity risks stemming from an entity’s supply chain and its relationship with its suppliers is particularly important given the prevalence of incidents where entities have fallen victim to attacks against information systems and where malicious actors were able to compromise the security of an entity’s network and information systems by exploiting vulnerabilities affecting third party products and services. entities should therefore assess and take into account the overall quality of products , the security measures embedded in them and the cybersecurity practices of their suppliers and service providers , including their secure development procedures and security features of the product.


### where applicable , those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. the notification shall not make the notifying entity subject to increased liability. ### those entities shall notify , without undue delay , the recipients of their services that are potentially affected by a significant cyber threat of any measures or remedies that those recipients can take in response to that threat. where appropriate , the entities shall also notify those recipients of the threat itself. by exception , where public disclosure could trigger further attacks against information systems , essential and important entities , could delay the notification. the notification shall not make the notifying entity subject to increased liability.


### article 23 ### deleted


### 1. dns service providers , tld name registries , cloud computing service providers , data centre service providers and content delivery network providers referred to in point 8 of annex i , as well as digital providers referred to in point 6 of annex ii shall be deemed to be under the jurisdiction of the member state in which they have their main establishment in the union. ### 1. cloud computing service providers , data centre service providers and content delivery network providers referred to in point 8 of annex i , as well as digital providers referred to in point 6 of annex ii shall be deemed to be under the jurisdiction of the member state in which they have their main establishment in the union.


### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the relevance of sectors , subsectors , size and type of entities referred to in annexes i and ii for the functioning of the economy and society in relation to cybersecurity. for this purpose and with a view to further advancing the strategic and operational cooperation , the commission shall take into account the reports of the cooperation group and the csirts network on the experience gained at a strategic and operational level. the first report shall be submitted by… [54 months after the date of entry into force of this directive]. ### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the relevance of sectors , subsectors , size and type of entities referred to in annexes i and ii for the functioning of the economy and society in relation to cybersecurity. for this purpose and with a view to further advancing the strategic and operational cooperation , the commission shall take into account the reports of the cooperation group and the csirts network on the experience gained at a strategic and operational level. the first report shall be submitted by… [36 months after the date of entry into force of this directive].


### articles 40 and 41 of directive (eu) 2018/1972 are deleted. ### articles 40 and 41 of directive (eu) 2018/1972 are to be applied insofar as they are not in contradiction with this directive.


### (32) the cooperation group should establish a work programme every two years including the actions to be undertaken by the group to implement its objectives and tasks. the timeframe of the first programme adopted under this directive should be aligned with the timeframe of the last programme adopted under directive (eu) 2016/1148 in order to avoid potential disruptions in the work of the group. ### (32) the cooperation group set up under this directive , should include representatives of member states , the commission , enisa and , due to the link with the data protection framework , the european data protection board (edpb). the cooperation group should establish a work programme every two years including the actions to be undertaken by the group to implement its objectives and tasks. the timeframe of the first programme adopted under this directive should be aligned with the timeframe of the last programme adopted under directive (eu) 2016/1148 in order to avoid potential disruptions in the work of the group.


### (65) in cases where a dns service provider , tld name registry , content delivery network provider , cloud computing service provider , data centre service provider and digital provider not established in the union offers services within the union , it should designate a representative. in order to determine whether such an entity is offering services within the union , it should be ascertained whether it is apparent that the entity is planning to offer services to persons in one or more member states. the mere accessibility in the union of the entity’s or an intermediary's website or of an email address and of other contact details , or the use of a language generally used in the third country where the entity is established , is as such insufficient to ascertain such an intention. however , factors such as the use of a language or a currency generally used in one or more member states with the possibility of ordering services in that other language , or the mentioning of customers or users who are in the union , may make it apparent that the entity is planning to offer services within the union. the representative should act on behalf of the entity and it should be possible for competent authorities or the csirts to contact the representative. the representative should be explicitly designated by a written mandate of the entity to act on the latter's behalf with regard to the latter's obligations under this directive , including incident reporting. ### (65) in cases where a content delivery network provider , cloud computing service provider , data centre service provider and digital provider not established in the union offers services within the union , it should designate a representative. in order to determine whether such an entity is offering services within the union , it should be ascertained whether it is apparent that the entity is planning to offer services to persons in one or more member states. the mere accessibility in the union of the entity’s or an intermediary's website or of an email address and of other contact details , or the use of a language generally used in the third country where the entity is established , is as such insufficient to ascertain such an intention. however , factors such as the use of a language or a currency generally used in one or more member states with the possibility of ordering services in that other language , or the mentioning of customers or users who are in the union , may make it apparent that the entity is planning to offer services within the union. the representative should act on behalf of the entity and it should be possible for competent authorities or the csirts to contact the representative. the representative should be explicitly designated by a written mandate of the entity to act on the latter's behalf with regard to the latter's obligations under this directive , including incident reporting.


### (iii) top–level domain name registries and domain name system (dns) service providers referred to in point 8 of annex i; ### deleted


### 4. this directive applies without prejudice to council directive 2008/114/ec30 and directives 2011/93/eu31 and 2013/40/eu32 of the european parliament and of the council. ### 4. this directive applies without prejudice to council directive 2008/114/ec30 and directives 2011/93/eu31 and 2013/40/eu32 and 2002/58/ec1a and regulation (eu) 2016/6791b of the european parliament and of the council.


### (9) ‘representative’ means any natural or legal person established in the union explicitly designated to act on behalf of i) a dns service provider , a top-level domain (tld) name registry , a cloud computing service provider , a data centre service provider , a content delivery network provider as referred to in point 8 of annex i or ii) entities referred to in point 6 of annex ii that are not established in the union , which may be addressed by a national competent authority or a csirt instead of the entity with regard to the obligations of that entity under this directive; ### (9) ‘representative’ means any natural or legal person established in the union explicitly designated to act on behalf of i) a cloud computing service provider , a data centre service provider , a content delivery network provider as referred to in point 8 of annex i or ii) entities referred to in point 6 of annex ii that are not established in the union , which may be addressed by a national competent authority or a csirt instead of the entity with regard to the obligations of that entity under this directive;


### (14) ‘dns service provider’ means an entity that provides recursive or authoritative domain name resolution services to internet end-users and other dns service providers; ### deleted


### (15) ‘top–level domain name registry’ means an entity which has been delegated a specific tld and is responsible for administering the tld including the registration of domain names under the tld and the technical operation of the tld , including the operation of its name servers , the maintenance of its databases and the distribution of tld zone files across name servers; ### deleted


### the cooperation group shall be composed of representatives of member states , the commission and enisa. the european external action service shall participate in the activities of the cooperation group as an observer. the european supervisory authorities (esas) in accordance with article 17(5)(c) of regulation (eu) xxxx/xxxx [the dora regulation] may participate in the activities of the cooperation group. ### the cooperation group shall be composed of representatives of member states , the commission , enisa and edpb. the european external action service shall participate in the activities of the cooperation group as an observer. the european supervisory authorities (esas) in accordance with article 17(5)(c) of regulation (eu) xxxx/xxxx [the dora regulation] may participate in the activities of the cooperation group.


### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union. ### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , to provide legal certainty , and incentives to produce low carbon batteries to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information to consumers and economic operators about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union.


### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union. ### (2) batteries are thus an important source of energy and one of the key enablers for sustainable development , green mobility , clean energy and climate neutrality. it is expected that the demand for batteries will grow rapidly in the coming years , notably for electric road transport vehicles using batteries for traction , making this market an increasingly strategic one at the global level. significant scientific and technical progress in the field of battery technology will continue. in view of the strategic importance of batteries , and to provide legal certainty to all operators involved and to avoid discrimination , barriers to trade and distortions on the market for batteries , it is necessary to set out rules on sustainability parameters , performance , safety , collection , recycling and second life of batteries as well as on information about batteries to consumers and economic operators. it is necessary to create a harmonised regulatory framework for dealing with the entire life cycle of batteries that are placed on the market in the union.


### having regard to the treaty on the functioning of the european union , and in particular article 114 thereof , ### having regard to the treaty on the functioning of the european union , and in particular article 114 thereof , and article 192(1) thereof in relation to chapter vii of this regulation ,


### 2. cadmium ### 1. portable batteries , whether or not incorporated into appliances , shall not contain more than 0 ,002% of cadmium (expressed as cadmium metal) by weight.


### amendment ### amendment


### the harmonised calculation rules referred to in article 7 shall build on the essential elements included in this annex , be in compliance with the latest version of the commission product environmental footprint80 (pef) method and relevant product environmental footprint category rules (pefcrs)81 and reflect the international agreements and technical/scientific progress in the area of life cycle assessment82 . ### the harmonised calculation rules referred to in article 7 shall build on the essential elements included in this annex , be in compliance with the latest version of the commission product environmental footprint80 (pef) method and relevant product environmental footprint category rules (pefcrs)81 and reflect the international agreements and technical/scientific progress in the area of life cycle assessment82 . the development and update of pef methods and relevant pefcrs shall be open and transparent. the commission shall ensure adequate representation of civil society organisations , academia , and other interested parties.


### raw material acquisition and pre-processing ### includes mining and pre-processing , up to the manufacturing of battery cells and batteries components (active materials , separator , electrolyte , casings , active and passive battery components) , and electric/electronics components.


### main product production ### assembly of battery cells and assembly of batteries with the battery cells and the electric/electronic components


### in proposing maximum carbon footprint thresholds , the commission will take into account the relative distribution of the carbon footprint values in batteries on the market , the extent of progress in the reduction of carbon footprint of batteries placed on the union market and the effective and potential contribution of this measure to the union’s objectives on sustainable mobility and climate neutrality by 2050. ### in proposing maximum carbon footprint thresholds , the commission will take into account the relative distribution of the carbon footprint values in batteries on the market , the extent of progress in the reduction of carbon footprint of batteries placed on the union market including best available upstream and downstream production processes and the effective and potential contribution of this measure to the union’s objectives on sustainable mobility and climate neutrality by 2050.


### 1. battery capacity , electric charge which a battery can deliver under a specific set of conditions. ### 1. real-life battery capacity , electric energy which a battery delivers under real-life conditions


### 1. battery capacity , electric charge which a battery can deliver under a specific set of conditions. ### 1. real-life battery capacity , electric charge which a battery delivers under real-life conditions.


### 5. an indication of their expected life-time under the conditions for which they have been designed. ### 5. expected life-time under the conditions for which they have been designed (in cycles and calendar years).


### 7. hazardous substances contained in the battery other than mercury , cadmium or lead; ### 7. hazardous substances contained in the battery above a concentration of 0 ,1 % weight by weight other than mercury , cadmium or lead;


### 8. critical raw materials contained in the battery. ### 8. critical raw materials contained in the battery above a concentration of 0 ,1 % weight by weight.


### the qr code shall be 100% black and of a size that is easily readable by a commonly available qr reader , such as those integrated in hand-held communication devices. ### the qr code shall be in a colour with a high contrast compared to its background and of a size that is easily readable by a commonly available qr reader , such as those integrated in hand-held communication devices.


### community life. ### community life , including that of indigenous people;


### oecd due diligence guidance for responsible supply chains of minerals from conflict-affected and high-risk areas. ### oecd guidelines for multinational enterprises.


### recycling of 50 % by average weight of other waste batteries. ### recycling of 60 % by average weight of other waste batteries.


### 90 % for cobalt; ### 95 % for cobalt;


### 90 % for lead; ### 95 % for lead;


### 90 % for nickel. ### 95 % for nickel.


### 2. requirements for the part of the system accessible only to accredited economic operators and the commission ### 2. requirements for the part of the system accessible only to independent operators , accredited economic operators and the commission


### the part of the system that shall be accessible only to accredited remanufacturers , second-life operators and recyclers shall contain: ### the part of the system that shall be accessible only to independent operators , accredited remanufacturers , second-life operators and recyclers shall contain:


### (13) batteries should be designed and manufactured so as to optimise their performance , durability and safety and to minimise their environmental footprint. it is appropriate to lay down specific sustainability requirements for rechargeable industrial batteries and electric vehicle batteries with internal storage with a capacity above 2 kwh as such batteries represent the market segment which is expected to increase most in the coming years. ### (13) batteries should be designed and manufactured so as to optimise their performance , durability and safety and to minimise their environmental footprint. it is appropriate to lay down specific sustainability requirements for rechargeable industrial batteries and electric vehicle batteries as such batteries represent the market segment which is expected to increase most in the coming years.