what are the consequences if I don't report a data breach to the AP

Failure to report can have consequences that extend beyond the breach itself

Anyone who fails to report a reportable data breach to the supervisory authority risks that authority discovering it independently and taking action under Article 33 of the GDPR, which sets out the obligation to notify within the timeframe specified therein. The Dutch Data Protection Authority and other European supervisory authorities have the power to investigate, ask questions, and impose sanctions where a violation is found. A breach often comes to light precisely because a data subject complains, because data appears elsewhere, or because a processor or service provider reports the breach and the supervisory authority follows up from there — see also what to do when a service provider reports a data breach.

Beyond the risk with the supervisory authority, there is another issue: the failure to report a breach is separate from the question of whether the people whose data is affected must be informed. That obligation follows from Article 34 of the GDPR and can remain in place even if notification to the supervisory authority has been omitted — with all the reputational damage and loss of trust that can result if this comes to light later. Even a breach that is not reportable should be recorded in your own documentation; see why non-reported data breaches should also be documented.

What the rules say about this

The obligation to notify is set out in Article 33 of the GDPR, and that obligation applies directly in every EU Member State. Where the notification goes differs by country: in the Netherlands it is the Dutch Data Protection Authority, in other Member States the national supervisory authority of that country — the EDPB maintains an overview of these supervisory authorities and publishes guidelines on the interpretation of the notification obligation. The precise details of when something must or must not be reported are described on the page about assessing whether a data breach must be reported.