How to report a data breach in the Netherlands

Before you start the form

Assemble the facts first. The form is not a draft tool, and the Autoriteit Persoonsgegevens can see timestamps on submissions. You need: a summary of what happened, when detection occurred, what categories of personal data were affected (names, email addresses, financial data, health data, and so on), an estimate of how many people are affected, your containment actions so far, and a contact person who can answer follow-up questions.

Appoint one person to own the filing, even if multiple colleagues contribute information. Regulators prefer a single point of contact.

Filling in the online form

The meldingsformulier is structured in sections: identification of the filing organisation, description of the breach, categories of personal data and people affected, likely consequences, measures taken, and whether the people affected have been informed. Each section accepts free text. Be factual and specific. 'Employee files with BSN, salary, and bank details of approximately 180 staff members' is better than 'HR data'.

If the breach involves special-category data (health, ethnicity, religion, sexual orientation, criminal records) flag this explicitly, because the Autoriteit Persoonsgegevens prioritises these filings and the risk threshold for informing affected individuals is lower.

What happens after filing

The Autoriteit Persoonsgegevens issues a receipt with a reference number. Keep this reference with the incident documentation. In most cases the regulator reviews the filing and does not open an investigation, particularly when the breach scope is limited and the response is demonstrably competent.

For larger breaches, or those involving special-category data, expect follow-up questions within two to four weeks. The regulator may request copies of the incident response plan, the internal breach register, evidence of notification to affected individuals, and technical forensics. Answer factually and promptly. Stonewalling is the clearest signal that escalates a regulatory review into a formal investigation.

Informing affected individuals

When the breach poses a high risk to the people affected, inform them directly in clear Dutch (or their language). The message should cover: the nature of the breach, the contact point for questions, the likely consequences, and the measures taken. Avoid legalese. The Autoriteit Persoonsgegevens has fined organisations whose notifications were so hedged that people did not understand what had happened to their data.

Email, letter, or in-product messaging are all acceptable channels. For very large breaches, a public communication on the corporate website, accompanied by a press release, is acceptable when individual notification is disproportionate.

When you need external support

If the breach is complex, if forensics are unclear, or if the organisation does not have a designated DPO and incident response capability, external support compresses the timeline. SecDesk delivers [Incident response](/phishing-incident-response) with senior responders who handle the technical containment, the forensics, and the regulatory filing in parallel. The 72-hour window is tight but workable with the right support, and the quality of the filing itself is a significant factor in whether the Autoriteit Persoonsgegevens opens a deeper investigation.