Digital Code, digital resilience incident notification

Chapter 11's own security article, Art. 88, carries no notification duty.

A general incident-notification duty exists instead at Art. 63, "Digital Resilience," outside Chapter 11 proper, now read in full at the official source in a reviewer pass and confirmed word for word: a record-owner or digital-service provider must notify the sectoral regulator of an incident affecting digital resilience or the rights and legitimate interests of subjects of legal relations in the digital environment within 72 hours of discovery (Art. 63(5); a late notice must explain the delay), and a processor must notify the record-owner within 48 hours of discovery (Art. 63(6)), with the notice describing the incident and an estimate of affected users, a responsible contact, a description of consequences, and remedial measures taken (Art. 63(7)), updated as new facts emerge (Art. 63(8)).

Art. 63 remains a general digital-resilience duty positioned outside Chapter 11 rather than a dedicated personal-data breach article, and Chapter 11 was not found to cross-reference it explicitly in what was read, but its own text plainly extends to "the rights and legitimate interests of subjects" in the digital environment, which covers a personal-data incident.