> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/35.md).

# Art. 35 — Infringements entailing a personal data breach

NIS2 Article 35 — Infringements entailing a personal data breach. Directive (EU) 2022/2555, Chapter VII — Supervision and enforcement.

1. Where the competent authorities become aware in the course of supervision or enforcement that the infringement by an essential or important [entity](https://headlesslaw.com/definitions/nis2/entity/) of the obligations laid down in [Articles 21](/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/21.md) and [23](/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/23.md) of this Directive can entail a personal data breach, as defined in Article 4, point (12), of Regulation (EU) 2016/679 which is to be notified pursuant to Article 33 of that Regulation, they shall, without undue delay, inform the supervisory authorities as referred to in Article 55 or 56 of that Regulation.
2. Where the supervisory authorities as referred to in Article 55 or 56 of Regulation (EU) 2016/679 impose an administrative fine pursuant to Article 58(2), point (i), of that Regulation, the competent authorities shall not impose an administrative fine pursuant to [Article 34](/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/34.md) of this Directive for an infringement referred to in paragraph 1 of this Article arising from the same conduct as that which was the subject of the administrative fine under Article 58(2), point (i), of Regulation (EU) 2016/679. The competent authorities may, however, impose the enforcement measures provided for in [Article 32(4)](/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/32.md), points (a) to (h), [Article 32(5)](/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/32.md) and [Article 33(4)](/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/33.md), points (a) to (g), of this Directive.
3. Where the supervisory authority competent pursuant to Regulation (EU) 2016/679 is established in another Member State than the competent authority, the competent authority shall inform the supervisory authority established in its own Member State of the potential data breach referred to in paragraph 1.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.mica.wtf/nis2/chapter-vii-supervision-and-enforcement-art.-31-37/35.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.