+Article 32 7.

Article 32 7.

When taking any of the enforcement measures referred to in paragraph 4 or 5, the competent authorities shall comply with the rights of the defence and take account of the circumstances of each individual case and, as a minimum, take due account of:

(a) 

the seriousness of the infringement and the importance of the provisions breached, the following, inter alia, constituting serious infringement in any event:

(i) 

repeated violations;

(ii) 

a failure to notify or remedy significant incidents;

(iii) 

a failure to remedy deficiencies following binding instructions from competent authorities;

(iv) 

the obstruction of audits or monitoring activities ordered by the competent authority following the finding of an infringement;

(v) 

providing false or grossly inaccurate information in relation to cybersecurity risk-management measures or reporting obligations laid down in Articles 21 and 23;

(b) 

the duration of the infringement;

(c) 

any relevant previous infringements by the entity concerned;

(d) 

any material or non-material damage caused, including any financial or economic loss, effects on other services and the number of users affected;

(e) 

any intent or negligence on the part of the perpetrator of the infringement;

(f) 

any measures taken by the entity to prevent or mitigate the material or non-material damage;

(g) 

any adherence to approved codes of conduct or approved certification mechanisms;

(h) 

the level of cooperation of the natural or legal persons held responsible with the competent authorities.

1. Pārskats

,

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie standarti

2. Identificētās prasības

Prasības

3. Saistītie standarti

Standarti