who is responsible for reporting a data breach within my company

The responsibility lies with the organisation, not with a single employee

The GDPR places the obligation to report with the organisation that is the controller, not with an individual staff member who discovers or causes the breach. Who within the company actually carries out the report is not regulated by the GDPR — that is an internal matter. In practice, this is usually the owner, a director, or someone specifically designated to handle privacy matters, such as a data protection officer if one has been appointed. For a sole trader or small business without a separate function, that responsibility often falls naturally to the person who runs the enterprise.

What is clear, however, is that there must be someone who knows that a report may be necessary as soon as a breach occurs, and who can assess whether what exactly constitutes a data breach applies here. A company that has not recorded who will handle this risks a breach being flagged but no one taking the next step — while the clock starts ticking from the moment of discovery. Even if processing has been outsourced to a third party, that does not change who remains responsible for reporting: it is and remains the organisation itself, even when a service provider reports a data breach themselves.

Where this follows from: Article 33 of the GDPR

Article 33 of the GDPR consistently refers to 'the controller' as the party that must report to the supervisory authority, without prescribing an internal function or person; who actually carries this out is up to the organisation itself. The Dutch Data Protection Authority confirms on its page about data breaches that the reporting obligation lies with the organisation and not with a specific member of staff. Which supervisory authority a report must be made to does vary per Member State: in the Netherlands this is the Dutch Data Protection Authority, while elsewhere in the EU the national supervisory authority is the designated body. More on the steps to be followed and the role of the supervisory authority can be found at when a data breach must be reported to the Dutch Data Protection Authority.