Data breaches and the duty to report

Module 8: When things go wrong · Reading time: 11 minutes

Learning objective: After this lesson, you can determine whether something is a data breach, whether you must report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), and whether you must inform the people affected, and you can record it in a breach register.

Key concepts: personal data, data breach (breach involving personal data), controller, processor, GDPR article 33 and 34, data breach reporting desk, 72 hours, risk and high risk, data breach register

What is a data breach?

When people hear "data breach", they think of hackers stealing a database. That's one form of it. The GDPR uses a broader description: a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (article 4, point 12).

Personal data is any data about an identifiable person: a name, an email address such as jan.jansen@..., a phone number, an address, a customer number with an order history, a photo, an IP address combined with other data. Data about a business as such (a company registration number, a general address) is not personal data, but data about the contact person is.

So all of the following are data breaches:

• an email with a customer list sent to the wrong recipient;
• a newsletter where all recipients are visible in the To or CC field;
• a lost USB stick or laptop containing staff data, if it wasn't encrypted;
• ransomware that encrypts your customer records (the data is then unavailable, even if nothing was copied);
• a hijacked mailbox containing invoices with names and addresses;
• a shared link to a folder of job applications that is open to everyone.

The phrase "breach of security" shows that it's not only about confidentiality. Loss (the data is gone) and alteration (someone has changed account numbers) count too.

Who is responsible: you or your supplier?

The GDPR has two roles.

• The controller determines why and how personal data is processed. For your customer and staff data, that's you, as the business owner.
• A processor processes data on your instructions: your hosting company, your cloud accounting package, your newsletter service, your IT supplier.

If a breach happens at a processor, they must inform you without undue delay (article 33(2)). You then assess whether you need to report it to the Dutch Data Protection Authority and to the people affected, and in principle you report it yourself (unless you've agreed that the processor will do this on your behalf). The obligation therefore stays with you, even if the fault lay with someone else. That's why a processing agreement sets out how quickly and how a processor must inform you (lesson 7.2).

The 72-hour clock

Article 33 of the GDPR says you must report a data breach without undue delay and, where feasible, within 72 hours to the Dutch Data Protection Authority, after becoming aware of it. The exception: it's unlikely that the breach poses a risk to people's rights and freedoms.

Four points are often misunderstood:

1. The clock starts when you become aware of it, not when the breach happened. "Becoming aware" means: you are reasonably certain that there is a breach involving personal data. A brief initial assessment is allowed, but deliberately not looking doesn't push the clock back.
2. 72 hours is 72 hours, including weekends and public holidays. If you discover a breach on Friday at 16:40, the deadline is Monday at 16:40.
3. An incomplete report is allowed. If you still don't know everything after 72 hours, you report what you know and add more later. If you report later than 72 hours, you must explain why; the Dutch Data Protection Authority only accepts this in exceptional cases.
4. It's about the risk to people, not the damage to your business.

Discovered:  Friday     16:40   -> clock starts
             Saturday           (counts)
             Sunday             (counts)
By Monday    16:40   -> report to the Dutch Data Protection Authority (may be incomplete)

You can only report via the online reporting form of the data breach reporting desk on the website of the Dutch Data Protection Authority; phone, email or a letter are not accepted. The Dutch Data Protection Authority has a questionnaire you can use to prepare the report in advance. Among other things, you fill in what happened, when, which and how many pieces of data and people are involved, what the possible consequences are, and what measures you took. This is where the log from lesson 8.1 pays off.

When to report and when not: assessing the risk

You assess how likely and how serious the consequences are for the people affected. Think of: identity fraud, financial damage, discrimination, reputational damage, or loss of control over their data. Helpful questions:

Two examples that come up often:

• An encrypted laptop is stolen, with a strong password, the key hasn't leaked, and there's a recent backup: probably no risk. No need to report to the Dutch Data Protection Authority, but do record it in your register.
• An online shop is hacked, and the attacker obtains email addresses and weakly stored passwords: a risk, so report it. And because people often reuse passwords (lesson 1.4), there's a high risk, so inform the people affected.

Not sure? Then reporting is usually the safe choice. The Dutch Data Protection Authority also advises reporting if in doubt. You can pass on new information later with a follow-up report.

Informing the people affected: in case of high risk

Article 34 concerns the people whose data it is. If the breach is likely to result in a high risk, you must inform them without undue delay: as quickly as reasonably possible. There's no 72-hour deadline for this, but waiting until everything has been investigated isn't the intention either.

The message should explain, in clear language, what happened, what the likely consequences are, what you're doing about it, and what they can do themselves (for example, change their password elsewhere, be alert to phishing in your name, warn their bank), plus a contact person.

You don't have to inform them if you had taken appropriate measures that make the data unreadable (such as strong encryption), if you took measures afterwards that mean the high risk is no longer likely, or if it would require a disproportionate effort: in that case you make a public statement instead (article 34(3)).

Note: phishing often follows a data breach. Criminals then know who your customers are and send an email "from you". Warn your customers about this too.

The data breach register: always

Article 33(5) requires you to record every data breach, even if you don't report it. Record: the facts, the consequences, the measures taken, and your assessment (why you did or didn't report it, why you did or didn't inform people). You can choose the format yourself; the Dutch Data Protection Authority has a sample breach register. A simple table is enough:

No | Discovered (date/time) | What happened | Which data, how many people
   | Consequences | Measures | Reported to the Dutch Data Protection Authority? (yes/no + why, date)
   | People informed? (yes/no + why) | Resolved (date)

The register also helps you: if you see "email to wrong recipient" three times a year, you know where to improve (for example, a send delay, or no more customer lists as attachments, lesson 7.3).

Data breach and the Cyberbeveiligingswet: two different reports

If your organisation falls under the Cyberbeveiligingswet (the Dutch Cybersecurity Act implementing NIS2, lesson 9.1), then a separate duty to report significant incidents also applies: an initial warning within 24 hours, a report within 72 hours, and a final report within a month, via MijnNCSC (registration portal of the NCSC). This is a different report, with a different purpose (the continuity of services) and to a different authority. A ransomware attack can therefore trigger both. Most small businesses don't fall under the Cyberbeveiligingswet; the GDPR duty to report applies to everyone.

This lesson provides general information and is not legal advice. If in doubt, consult the website of the Dutch Data Protection Authority or a lawyer.

Summary

• A data breach is any breach that causes personal data to be lost, altered, or to end up with someone who shouldn't have it; this also includes an email to the wrong recipient or a lost, unencrypted laptop.
• Reporting to the Dutch Data Protection Authority: without undue delay and, where feasible, within 72 hours of discovery, including weekends, unless there's probably no risk. An incomplete report is allowed.
• Informing the people affected: without undue delay, if there's likely a high risk.
• If the breach happens at your processor, they must inform you; the decision on whether to report lies with you.
• Record every data breach in your breach register, including your assessment.

Quiz

Exercise

Exercise A8.2: Work out the deadline. You're given four discovery moments. For each one, fill in the final date and time for reporting to the Dutch Data Protection Authority. The programme checks your answers.

Exercise A8.2b: Report or not? You're given eight short cases. For each case, decide whether you must report it to the Dutch Data Protection Authority, whether you must inform the people affected, and whether you record it in your data breach register. The programme checks your answers and gives an explanation for each case.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers the process works in a similar way.

• Help! My site has been hacked. How can I fix or prevent this?
• Dutch Data Protection Authority, Sample data breach register: https://www.autoriteitpersoonsgegevens.nl/documenten/voorbeeld-datalekregister
• Dutch Data Protection Authority, Duty to report data breaches: https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/beveiliging/meldplicht-datalekken
• Dutch Data Protection Authority, Questionnaire for the data breach reporting form: https://www.autoriteitpersoonsgegevens.nl/documenten/vragenlijst-meldformulier-datalekken
• GDPR (Regulation (EU) 2016/679), articles 4, 33 and 34: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• NCSC, Reporting a data breach: https://www.ncsc.nl/wet-en-regelgeving/melden-van-een-datalek