Every Dutch business that processes personal data must secure it under Article 32 GDPR and report a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) within 72 hours under Article 33 GDPR. On top of that, since 15 August 2026 more than 8,000 essential and important organisations must also comply with the Cyber Security Act (Cyberbeveiligingswet, Cbw), the Dutch implementation of the EU NIS2 directive; banks and other financial entities follow DORA for these matters instead.
د معلوماتو امنیت لپاره GDPR څه ته اړتیا لري؟
Appropriate technical and organisational measures, assessed against the state of the art, the cost of implementation and the risk to the people concerned (Article 32 GDPR). What is appropriate for a two-person practice differs from what a company processing health data at scale needs; the standard rises with the risk.
The AP expects to see unremarkable measures: access control and multi-factor authentication, encryption of devices and backups, patching, logging and a tested restore procedure. What helps you survive scrutiny is that these measures were documented and reviewed before anything went wrong.
کله باید د معلوماتو د سرغړونې راپور ورکړل شي؟
Within 72 hours of becoming aware of it, to the AP, unless the breach is unlikely to result in a risk to the people affected (Article 33 GDPR). Where the risk to them is high, you must also inform those people without undue delay (Article 34 GDPR).
The clock runs from awareness, not from a completed investigation, so an incident procedure (who decides, who is called, what is recorded) is worth more than any single technical control. Under Article 33(5) GDPR, you must record every breach internally, including those you do not report, with the reasoning for that decision.
د Cyberbeveiligingswet څه اضافه کوي؟
Registration, a duty of care and incident reporting for organisations in 18 sectors, such as energy, transport, healthcare, digital infrastructure and public administration. The Cbw and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten) entered into force on 15 August 2026. In-scope organisations must register with the National Cyber Security Centre (NCSC), take risk-management measures and report significant incidents to the CSIRT and their sector supervisor within the statutory periods.
The management board must approve and oversee these measures and must have sufficient knowledge, including training; it cannot simply delegate this to the IT department. Within days of entry into force only about 3,200 of the more than 8,000 organisations had registered, so check your registration now if you may be in scope.
How does this reach organisations outside the scope of the Cbw?
Through contracts. Larger customers increasingly impose security requirements, audit rights and breach-notification periods, and a processing agreement under Article 28 GDPR is compulsory whenever you process personal data on someone else’s behalf. Many Dutch companies first meet these standards because a customer in scope of the Cbw demanded them.
څوک د پیښې وروسته ادعا کولی شي؟
The AP, which can fine up to €20 million or 4% of worldwide turnover under Article 83 GDPR; individuals, who can claim compensation under Article 82 GDPR; customers under the contract; and groups through a collective action under the WAMCA. Whether your insurance pays depends on the policy wording and on whether you can show the agreed measures were in place.
What should you check as an organisation in scope of the Cbw?
- Have you registered with the NCSC?
- Has the board approved the risk-management measures and completed training?
- Do you know your sector’s thresholds for a significant incident and to whom you report?
- Do your supplier contracts impose security and notification duties?
- Can you also report a personal data breach to the AP within 72 hours?
What should you check as a supplier to such organisations?
- Which security requirements and audit rights does your customer contract impose?
- How quickly must you notify your customer of an incident?
- Is there a processing agreement under Article 28 GDPR where you handle personal data?
- Is your liability for an incident capped, and does your insurance cover it?
What can we do for you with cybersecurity obligations?
زموږ د معلوماتي ټکنالوژۍ وکیلان advise on the legal side of cybersecurity. We can:
- Assess whether your organisation falls within the scope of the Cbw.
- Draft or review processing agreements and security clauses in supplier contracts.
- Write your incident and breach-notification procedure.
- Handle the breach notification and correspondence with the AP.
- Advise on liability toward customers and individuals after an incident.
لنډیز
- Article 32 GDPR requires security measures matched to the state of the art and the risk, for every organisation that processes personal data.
- A data breach must normally be reported to the AP within 72 hours of becoming aware of it.
- Since 15 August 2026, the Cbw adds registration, risk-management and incident-reporting duties for more than 8,000 organisations, with board accountability.
- An incident can trigger claims from the AP, individuals, customers and collective actions.
