With regard to data centre service providers, an incident shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria:
- a data centre service of a data centre operated by the provider is completely unavailable;
- the availability of a data centre service of a data centre operated by the provider is limited for a duration of more than one hour;
- the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of a data centre service is compromised as a result of a suspectedly malicious action;
- physical access to a data centre operated by the provider is compromised.