Notification of a personal data breach to the supervisory authority
Art. 33
-
Last updated
Mandatory
Catalog reference
Notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Document the facts, effects, and remedial action taken, even for breaches you decide not to report.
Narrative — how we satisfy this requirement
A suspected breach goes to the Incident Coordinator, who decides with the Data Protection Officer on notifying the Dutch Data Protection Authority within 72 hours.