The procedures that providers of public electronic communications services (such as telecommunications operators and internet service providers) (service providers) must follow in the event of a personal data breach, together with their security obligations, under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (2003/2426) (as amended) (PECR 2003) and the UK Notification Regulation.