Article 5, Paragraph 2. · Commission Implementing Regulation (EU) 2025/847

Contents

2.The information provided in accordance with paragraph 1 shall include at least the following:

(a)the name of the provider of the wallet solution the provision and the use of which has been suspended;

(b)the name and reference identifier of that wallet solution, as indicated in the list of certified wallets drawn up pursuant to Article 5d of Regulation (EU) No 910/2014, and, where applicable, the concerned versions;

(c)the date and time when the security breach or compromise was detected;

(d)if known, the date and time when the security breach or compromise became effective, based on network or system logs or other data sources;

(e)the date and time of the suspension of the wallet solution;

(f)contact details, including at least an email address and a telephone number for the notifying Member State, and, where different, for the wallet provider referred to in point (a);

(g)a description of the security breach or compromise;

(h)a description of the data compromised, including, where applicable, the categories of personal data as defined in Article 9(1) and Article 10 of Regulation (EU) 2016/679;

(i)where possible, an estimate of the approximate number of wallet users affected and of other natural persons affected;

(j)a description of the potential impacts on wallet-relying parties or on wallet users, and in the latter case, where relevant, any indications of measures that wallet users can take to mitigate those potential impacts;

(k)a description of the measures taken or planned to remedy the security breach or compromise, together with a planning and deadline for such remedy;

(l)where applicable and appropriate, a description of the measures taken or planned for transitioning wallet users affected to alternative wallet solutions or services.

Defined terms · 10

Show every defined term

critical assets
means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;
wallet instance
means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit;
wallet provider
means a natural or legal person who provides wallet solutions;
wallet secure cryptographic application
means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;
wallet secure cryptographic device
means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;
wallet solution
means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;
wallet unit
means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user;
wallet unit attestation
means a data object that describes the components of the wallet unit or allows authentication and validation of those components.
wallet user
means a user who is in control of the wallet unit;
wallet-relying party
means a relying party that intends to rely upon wallet units for the provision of public or private services by means of digital interaction;