my supplier reports a data breach do I also need to report it myself

A data breach at your supplier can also trigger your reporting obligation

Yes, it can, even if the supplier has already reported the breach itself. A supplier who processes customer data for you — an accounting package, a mailing tool, a hosting provider — is in the language of the GDPR usually a processor, and you yourself remain the controller. The obligation to report to the supervisory authority and to data subjects lies with the controller, not with the processor. The supplier who reports it to their own supervisory authority thus does not automatically cover your own obligation.

What the supplier must do according to the processor agreement is to notify you of the breach without undue delay as soon as they become aware of it. From that moment on, you begin the assessment of whether this constitutes a personal data breach as referred to in what exactly is a data breach?,and whether it is reportable to the Dutch Data Protection Authority and possibly to the data subjects. The fact that a supplier has reported the incident to their own supervisory authority — sometimes in another country — does not change the assessment you must make as the controller.

Where this follows from Article 28 and Article 33 of the GDPR

Article 28 of the GDPR governs the relationship between controller and processor, and the associated processor agreement establishes that the processor must notify the controller of a breach; Article 33 of the GDPR sets out the reporting obligation to the supervisory authority at the controller, with the timeframe and criteria that the Dutch Data Protection Authority and the EDPB further elaborate in their guidelines. This division applies equally in every Member State, only the supervisory authority that receives the notification differs: in the Netherlands it is the Dutch Data Protection Authority, in other Member States the supervisory authority of that country — relevant if the supplier is located there or if customer data of data subjects from multiple countries is involved. What your own agreements with the supplier must regulate in this regard, and whether that agreement is adequate, is described under must I sign a processor agreement that my customer sends me?.