Article 7 – Significant incidents with regard to cloud computing service providers

With regard to cloud computing service providers, an incident shall be considered significant under Article 3 where it fulfils one or more of the following criteria:

(a) one or more of the cloud computing services provided is completely unavailable for more than 10 minutes;

(b) for one or more of the cloud computing services provided, the customer service level agreement is not met for more than 5 % of the cloud computing service users in the Union, or for more than 1 million of the cloud computing service users in the Union, whichever number is smaller, for a duration of more than one hour;

(c) the availability of the cloud computing service of a provider that has no customer service level agreement in place is limited for more than 5 % of the cloud computing service users in the Union, or for more than 1 million of the cloud computing service users in the Union, whichever number is smaller, for a duration of more than one hour;

(d) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of the cloud computing service is compromised as a result of a suspectedly malicious action,

(e) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of the cloud computing service is compromised with an impact on more than 5 % of the cloud computing service users in the Union.