Rules
What a data breach is, the different types, when to notify the supervisory authority and the people concerned, and what to do in the first 72 hours.
A data breach is a breach of personal data security resulting in data being destroyed, lost, altered or reaching someone who should not have access. It may happen accidentally or deliberately. A human mistake counts too, such as an email to the wrong recipient.
The everyday Dutch term “datalek” does not appear in the legislation. The text of the GDPR, Article 4(12), uses “personal data breach”: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, data transmitted, stored or otherwise processed.
It therefore concerns personal data, something must have gone wrong with security, and it need not have leaked outside: loss and alteration count too. This article explains, rather than providing legal advice. You assess whether an incident requires notification yourself, preferably with your data protection officer or a lawyer.
On its page what is a data breach, the Autoriteit Persoonsgegevens (AP) distinguishes three types. A breach may fall into more than one at once.
The type helps determine the consequences. The AP therefore lists the nature of the breach as the first risk assessment factor.
The AP's examples include an email to the wrong addressee, an unauthorised employee viewing a medical file, a lost device holding unencrypted data and ransomware infection. Below are five forms common in firms. The examples are fictional.
An employee at a fictional bookkeeping firm sends client A's annual income statement to client B. This is a confidentiality breach. Whether notification is required depends on the contents and recipient.
A laptop is left on a train. If it contained personal data and its drive was unencrypted, this is a data breach. With sound encryption, the position differs.
Ransomware causes an availability breach and often a confidentiality breach too: data has then been copied before encryption. With phishing, an employee discloses login details and an outsider can read a mailbox, including all its personal data.
A personnel folder open to the whole organisation, or a shared link anyone can open, gives access to unauthorised people. Such breaches often become visible only when search or an AI assistant suddenly makes the folder discoverable; see Copilot and SharePoint.
An employee pastes a client file into an AI chatbot using a personal account. The AP warned about this in August 2024 in Warning: using an AI chatbot can cause data breaches. If entered on the employee's own initiative against the employer's agreed rules, the AP considers this a data breach: the company behind the chatbot gains unauthorised access to the data. If use is part of organisational policy, the AP says it is not a data breach, but often not legally permitted. This has its own article: A data breach through an AI chatbot: when must you notify the AP?.
Article 33 GDPR gives the rule: notify a data breach to the supervisory authority unless it is unlikely to pose a risk to the rights and freedoms of the people concerned. Notification is the starting point. You make the assessment yourself.
On its page whether to report a data breach, the AP gives factors for an objective assessment.
Which data counts as special category and why is explained in Special category data: what is it, and may AI process it?.
According to the AP, notification is unnecessary if, before the breach, you had taken measures making data unintelligible to unauthorised people, such as strong encryption or replacement with a hash value. Three conditions apply: the data is still intact, you retain full control over it (there is a recent backup), and the key has not been compromised.
The table applies these factors to fictional situations. It indicates the usual direction of assessment; the circumstances of your case decide.
| Example | Is it a data breach? | Notify the AP? | Inform data subjects? |
|---|---|---|---|
| Payslips with BSNs sent to an unknown email address | Yes | Usually yes: the AP calls a BSN with additional data sensitive | Depends on the risk of misuse |
| Medical file viewed by an employee without a treatment relationship | Yes | Usually yes: health data | Probably yes |
| Laptop with a well-encrypted drive lost, key safe, backup available | A breach you record | No, if all three conditions are met | No |
| Ransomware encrypts client files and files have been copied | Yes | Usually yes | Probably yes; depends on what was stolen |
| Client file entered into an AI chatbot on a personal account against agreed rules | Yes, according to the AP | Depends on sensitivity and what the provider does with input | Only where a high risk is likely |
| Price list without personal data sent to a competitor | No | Not applicable | Not applicable |
If in doubt, the AP advises erring on the side of caution and notifying.
The threshold is higher for the people concerned. Article 34 requires communication to data subjects when the breach is likely to pose a high risk. If notification to the AP is unnecessary, you need not inform data subjects either.
Communicate without undue delay in clear language: what happened, the likely consequences, your measures and a contact point. On its page how to inform victims about a data breach, the AP recommends avoiding jargon and stating immediately that the reader's data has been affected.
Article 34(3) gives three situations: the data had already been rendered unintelligible, for example through encryption; subsequent measures mean the high risk is no longer likely; or individual notification requires disproportionate effort, in which case a public communication replaces it.
Articles 41 and 42 of the Dutch GDPR Implementation Act add Dutch exceptions. For example, Article 34 does not apply to financial undertakings under the Dutch Financial Supervision Act; notification to the AP still applies to them.
The 72-hour period starts when you become aware, not at the incident itself. In their Guidelines 9/2022 on breach notification, European supervisory authorities explain that awareness begins once you know with a reasonable degree of certainty that personal data has been compromised. An initial investigation is permitted if started as soon as possible.
Article 33(3) names four components: the nature of the breach, where possible including categories and approximate numbers of data subjects and records; the DPO's or another contact point's details; likely consequences; and measures taken or proposed. If you do not yet know everything, you may supply information in phases without undue delay. If notifying after 72 hours, include reasons for the delay.
Article 33(5) requires documentation of all breaches: facts, effects and remedial action. This allows the supervisory authority to check whether you meet notification obligations. European supervisory authorities encourage an internal register, including breaches not requiring notification. On its data breaches page, the AP provides an example register.
A useful entry contains the facts and discovery time, types of data and groups of people, cause, risk assessment with reasons for notifying or not, and measures.
The breach register differs from the record of processing activities, which describes what your organisation does with personal data. See Records of processing activities: what to include, with an AI tool example.
The notification duty rests with the controller: the organisation deciding why and how data is processed. If a breach occurs at a processor, such as a payroll processor or software supplier, Article 33(2) requires it to inform you without undue delay. The risk assessment and notification remain your responsibility.
Agree in the data processing agreement how quickly a supplier reports an incident and with what information. What to check with AI providers is explained in the data processing agreement with an AI provider.
The AP writes that it can impose a fine if you wrongly fail to notify a breach, and require you to inform data subjects afterwards. Articles 33 and 34 obligations fall under Article 83(4) GDPR. That paragraph sets a maximum of €10 million or, for an undertaking, 2% of worldwide annual turnover in the preceding financial year, whichever is higher.
Those are statutory maxima, not usual amounts. The amount in a specific case depends on the circumstances. Other sanctions available to the AP, from a reprimand to an order subject to periodic penalty payments, are on its page fines and other sanctions.
PrivaSearch focuses on one cause in this article: the entire client file sent to an AI service because someone wants a question answered. In PrivaSearch, personal data in documents is first detected and replaced with pseudonyms. A colleague sees the original alongside the pseudonymised text and approves it. Only then is a document searchable. The steps are on how PrivaSearch works.
A connected AI assistant searches only those released passages and receives no original files, filenames or links. You can connect Claude, ChatGPT Business and Mistral Vibe (formerly Le Chat). Access is per project and actions are logged. Read more on ChatGPT, Claude, Mistral Vibe and the GDPR.
There are boundaries. Automatic detection is never complete, which is why review is mandatory. What employees type into an assistant goes directly to its provider. And pseudonymised data remains personal data for your organisation: notification duties, risk assessment and the register remain yours. For what goes wrong with uncontrolled use, see the risks of AI on your client files.
To see what this looks like with your type of client file, book a demo.
A data breach is an incident in which personal data is lost, altered or reaches someone who should not see it because of a security failure. It need not be an attack. An email to the wrong address, a lost unencrypted laptop or a folder open to everyone are data breaches too.
No. You report a breach unless a risk to the people concerned is unlikely. You make that assessment yourself, based on factors including data sensitivity, identifiability and the recipient. If in doubt, the supervisory authority advises notifying. Recording it in your own register is always required.
Without undue delay and, where feasible, within 72 hours of becoming aware. The period starts when you know with reasonable certainty that personal data has been affected, not at the incident itself. If reporting later, include the reason for delay. Missing information may be supplied in phases afterwards.
Use the reporting portal on the Autoriteit Persoonsgegevens website. Describe what happened, which types of data and approximately how many people are affected, likely consequences and measures taken. The same portal lets you supplement, amend or withdraw an earlier notification if your investigation reveals something different.
Yes, if it contained personal data. It is a confidentiality breach even if accidental. Whether you must notify depends on the contents and recipient. An appointment confirmation weighs differently from a payslip with a BSN. Record your assessment in both cases.
A security incident is any event where security was or risked being compromised. It becomes a data breach if personal data is destroyed, lost, altered or disclosed or accessed without authorisation as a result. A blocked intrusion attempt or an outage without consequences for personal data is therefore an incident, but not a data breach.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →