Data breach (datalek)

What is a data breach?

A data breach is a security breach that causes personal data to end up in the wrong hands, to be lost or to be changed. It does not have to be a hack. A mistake counts too.

Examples that the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) gives: an email with personal data sent to the wrong recipient, a lost USB stick without encryption, a cyberattack in which data has been stolen and ransomware that locks data. It concerns personal data as meant by the GDPR.

How do you report a data breach?

The AP lists four steps:

1. Get an overview: what happened, which data, and how many people are involved?
2. Stop the breach and limit the damage. For example, block an account or take a file offline.
3. Decide whether you need to report. You report the breach to the AP, unless it is unlikely to pose a risk to the people concerned. You do so within 72 hours of knowing that it is a data breach. Is the risk likely to be high? Then you also inform those people themselves.
4. Record the breach in your data breach register. Breaches that you do not report also belong in it.

Example in an SME

What should you watch for with a data breach?

• Agree who in your business reports a possible breach, and to whom.
• Does a supplier work with your data? Set out in the data processing agreement that they report a breach to you. You remain responsible for the report to the AP.
• Two-factor authentication, encryption and a good backup make a breach less likely, or less serious.

Are you having software built that works with customer data? Read how I approach custom software.

Frequently asked questions

This is an explanation in plain language, not legal advice.

Sources: AP: What is a data breach? (in Dutch), AP: Data breach? This is what you must do (in Dutch), AP: Data breach: to report or not (in Dutch) and AP: How to report a data breach (in Dutch). Consulted on 7 October 2026.