Consider the following statements with reference to the latest guidelines issued by the Indian Computer Emergency Response Team (CERT-In):

1. Data centres and service providers shall compulsorily report cyber security breaches within 24 hours.

2. Virtual Private Network providers shall retain user data for at least five years and share records with authorities when required. 

Which of the statements given above is/are correct?