Notification of a personal data breach to the supervisory authority
Art. 33
-
Last updated
Mandatory
Catalog reference
Notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Document the facts, effects, and remedial action taken, even for breaches you decide not to report.
Narrative — how we satisfy this requirement
A suspected breach goes to the Incident Coordinator, who decides with the Data Protection Officer on notifying the Dutch Data Protection Authority within 72 hours.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due