Must I also keep track of data breaches that I do not report?

Breaches without notification also belong in the register

Yes, in most cases every data breach gets a place in the register, even if no notification has been made to a supervisory authority. The register is not intended as an overview of notifications, but as an overview of all breaches that have occurred, including the assessment made in each case: what happened, which data were involved, what risk was assessed and why notification was or was not made. A breach that does not result in a notification obligation because the risk to the data subjects was assessed as low falls under this category.

What usually does not need to be in the register are incidents that are not a breach of personal data — for example a malfunction without data being leaked, lost or unlawfully processed. As soon as there is a breach, it counts towards the register, regardless of whether notification was made to the supervisory authority and regardless of whether data subjects were informed.

This follows from the documentation obligation of Article 33 of the GDPR

Article 33 of the GDPR regulates not only notification within 72 hours, but also contains a separate documentation obligation: every breach of personal data is recorded, with the facts, the consequences and the measures taken, so that a supervisory authority can check this later. That recording obligation is separate from the question of whether notification was actually made. Which supervisory authority can request that register varies by member state — in the Netherlands it is the Dutch Data Protection Authority, in Germany the supervisory authority of the state where the establishment is located — but the obligation to document comes directly from the Regulation and applies in that form equally in every member state. The Dutch Data Protection Authority also points out in its information about data breaches that recording is a separate step, separate from whether or not notification is made.