Skip to content

Reporting a breach: DPA, NCSC and data subjects

Reporting clocks run in parallel: GDPR, sector rules and contracts. This page separates them so you do not miss a deadline.

Book an informal conversation

ISO Ready helps you align policy, risk, and evidence, without endless document churn.

Check your NIS2 gaps

Part 2: reporting obligations (Netherlands-focused).

Dutch DPA, 72 hours

Notify within 72 hours of awareness unless the breach is unlikely to pose a risk. Initial notification may be incomplete; update later.

NCSC, NIS2 / Cbw

Essential and important entities may need early NCSC reporting (often cited as ~24 hours for significant incidents). See NIS2 and Cyber Security Act NL.

Data subjects & contracts

Inform individuals when likely high risk. Notify processors, customers and suppliers per contracts.

Next: content & register

Key takeaways

  • DPA: within 72 hours of awareness when required under GDPR.
  • NCSC: early reporting may apply under NIS2 / Dutch Cyber Security Act.
  • Inform data subjects when high risk, plain language.
  • Notify counterparties per contracts and DPAs.

Need help with the next step?

Explore support for your next step at ISO Ready. ISO Ready and this knowledge base are operated by Oosterwal Consultancy.

Explore your next step at ISO Ready

isocertificering.org is operated by Oosterwal Consultancy (oosterwal.com). ISO Ready (iso-ready.nl) has the same owner. Links to ISO Ready refer to our own commercial offering. About us (Dutch)

AI reading guide (llms.txt)