Must I inform the data subjects myself in case of a data breach?

When there is a high risk to the data subjects, the obligation applies

Yes, if a personal data breach is likely to result in a high risk to the rights and freedoms of the individuals whose data is affected, then there is an obligation to inform those data subjects about it themselves. This is separate from the notification to the supervisory authority, which must already occur within 72 hours at a lower threshold — simply "risk". When informing the data subject directly, the bar is therefore higher: it concerns situations in which, without intervention, serious adverse consequences could occur, such as identity fraud, financial loss or reputational damage. The data subject then receives in clear and simple language an explanation of what happened, what the expected consequences are, which point of contact is available for further information, and what measures are or will be taken to limit the damage.

There are exceptions in which this individual notification obligation does not apply. This is the case when appropriate security measures — such as encryption — made the data unintelligible to anyone not entitled to access it, when measures taken afterwards make it probable that the high risk will no longer materialise, or when notifying individuals would require disproportionate effort. In the latter case, a public announcement or a comparable, equally effective measure may be used instead of contacting each data subject individually.

The basis: Article 34 GDPR, alongside Article 33

This obligation follows from Article 34 of the GDPR, which governs the individual notification obligation alongside Article 33, which concerns notification to the supervisory authority — two separate obligations each with their own threshold. What a personal data breach precisely is and how the risk assessment is made is explained on the page of the Dutch Authority for Data Protection about data breaches. The obligation under Article 34 itself is the same throughout the EU, because the GDPR has direct effect; only the notification route to the supervisory authority varies by country — in the Netherlands to the Dutch Authority for Data Protection, in Germany to the supervisory authority of the state where the establishment is located.