Article 8 – Significant incidents with regard to data centre service providers

With regard to data centre service providers, an incident shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria:

  1. a data centre service of a data centre operated by the provider is completely unavailable;
  2. the availability of a data centre service of a data centre operated by the provider is limited for a duration of more than one hour;
  3. the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of a data centre service is compromised as a result of a suspectedly malicious action;
  4. physical access to a data centre operated by the provider is compromised.