When must I report a data breach to the Dutch Data Protection Authority?

Reporting is the default rule, unless a risk is unlikely

You report a personal data breach to the supervisory authority as soon as it is likely that the breach presents a risk to the rights and freedoms of the individuals whose data has been affected. This is the essence of Article 33 GDPR: notification is the starting point, and only when it is reasonable to conclude that no risk will arise does that notification not take place. In practice, this means that most breaches involving personal data — a misdirected email containing customer information, a stolen laptop, a hacked database — fall under the notification obligation, while a breach that clearly cannot affect anyone (for example because the data was encrypted and the key was not compromised) may fall outside it.

For that assessment, you look at what exactly happened, what data is involved and who could be affected by it. Special categories of data, financial data or data concerning children carry greater weight than a standalone email address. The 72-hour clock under Article 33 GDPR starts running from the moment you become aware of the breach, not from the moment it occurred — these two points sometimes lie weeks apart. A decision tree that works through this assessment step by step is never a substitute for your own judgment about the specific breach, but it does help to work through the question "reportable or not" in a structured manner.

Where this follows from Article 33 GDPR and the EDPB guidelines

The notification obligation itself is set out in Article 33 GDPR; the interpretation of concepts such as 'risk' and 'without undue delay' comes from the EDPB guidelines on personal data breach notifications, and the Dutch Data Protection Authority clarifies this for Dutch practice. The GDPR applies directly in every Member State, but whom you notify varies: in the Netherlands, it is the notification desk of the Dutch Data Protection Authority, the sole supervisory authority for the entire country. In Germany, you notify the supervisory authority of the state where the establishment is located, since there are sixteen state supervisory authorities alongside a federal supervisory authority.