Article 35Infringements entailing a personal data breach
1. Where the competent authorities become aware in the course of supervision or enforcement that the infringement by an essential or important entity of the obligations laid down in Articles 21 and 23 of this Directive can entail a personal data breach, as defined in Article 4, point (12), of Regulation (EU) 2016/679 which is to be notified pursuant to Article 33 of that Regulation, they shall, without undue delay, inform the supervisory authorities as referred to in Article 55 or 56 of that Regulation.
2. Where the supervisory authorities as referred to in Article 55 or 56 of Regulation (EU) 2016/679 impose an administrative fine pursuant to Article 58(2), point (i), of that Regulation, the competent authorities shall not impose an administrative fine pursuant to Article 34 of this Directive for an infringement referred to in paragraph 1 of this Article arising from the same conduct as that which was the subject of the administrative fine under Article 58(2), point (i), of Regulation (EU) 2016/679. The competent authorities may, however, impose the enforcement measures provided for in Article 32(4), points (a) to (h), Article 32(5) and Article 33(4), points (a) to (g), of this Directive.
3. Where the supervisory authority competent pursuant to Regulation (EU) 2016/679 is established in another Member State than the competent authority, the competent authority shall inform the supervisory authority established in its own Member State of the potential data breach referred to in paragraph 1.
NIS2, the European Union directive on network and information security, Article 35
When an authority becomes aware, during supervision or enforcement, that an infringement of Article 21 or 23 by an essential or important entity can entail a personal data breach that must be notified under Article 33 GDPR, it must inform the GDPR supervisory authority without undue delay. If that authority is in another Member State, it informs the GDPR supervisory authority in its own Member State.
If a GDPR supervisory authority has imposed an administrative fine under Article 58(2)(i) GDPR for conduct that is also such an infringement, the NIS2 authority may not impose an Article 34 fine for that conduct. It may still use the enforcement measures in Articles 32 and 33, for example warnings, binding instructions, public disclosure and, for essential entities, the Article 32(5) powers.
The bar is narrow: fines only, the same conduct, and the case where the GDPR fine comes first. The article is silent on supervisory measures such as audits and on the opposite order of fines.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.