Data Breach: When to Report, When Not To, Within 72 Hours

Not every incident is a data breach. Not every data breach needs to be reported to the AP. Here's the decision tree and a sample notification template.

A data breach is a security incident in which personal data has been destroyed, lost, altered, disclosed, or accessed by unauthorised parties. So when do you need to report it?

Decision Tree

\n
1. Is it a data breach? If in doubt: yes.
\n
2. Is there a risk to those affected? Is the data publicly exposed? Could it cause financial harm? Is there a risk of identity fraud?
\n
3. Low risk (e.g. lost encrypted device): no need to report to the AP, but do record it internally in your incident log.
\n
4. Significant risk: report to the AP within 72 hours.
\n
5. High risk to those affected: also notify the affected individuals directly.
\n

What to Report

\n
• The nature of the data breach.
\n
• Categories and number of individuals affected.
\n
• Categories and number of personal data records involved.
\n
• The consequences of the breach.
\n
• Measures taken or proposed.
\n
• Contact details of the DPO or designated contact person.
\n

The 72-Hour Clock

The clock starts from the moment you became aware of the breach — not from when it actually occurred. Weekends count. A partial report is allowed, with a follow-up submission later.

Where to Report

autoriteitpersoonsgegevens.nl — use the online data breach notification form. Keep a copy for your records.

What to Do Within Your Organisation

\n
• Assemble your team: security lead, director, communications.
\n
• Investigate: what exactly happened?
\n
• Containment: stop the breach.
\n
• Forensic documentation: preserve evidence for the investigation.
\n
• Prepare communications: internal, external, and media.
\n

See also: setting up an incident log, incident response.