my business mailbox has been hacked do I need to report it

A hacked mailbox is usually a data breach; reporting depends on the consequences

A hacked business mailbox is in most cases a personal data breach within the meaning of the GDPR: there is unauthorized access to personal data, and that access occurs almost as soon as someone from outside logs in to an account containing customer or contact information. This establishes that something has happened that falls under the definition of what exactly is a data breach? However, this is not automatically the same as a duty to report to the supervisory authority.

Whether reporting to the supervisory authority is necessary depends on the risk that the breach poses to the people whose data were in that mailbox — think of invoices with address data, quotes with ID numbers, or correspondence with sensitive content. A mailbox containing only business contact details of other companies poses a different risk than a mailbox full of client files or medical correspondence. That assessment, and the steps that go with it, are set out on the page about when must I report a data breach to the Dutch Data Protection Authority?Aside from reporting to the supervisory authority, there is also the question of whether the individuals themselves need to be notified, which has a separate assessment framework.

Legal basis in the GDPR: the definition of breach and the reporting obligation

The foundation lies in Article 4 of the GDPR, which defines a personal data breach as access to, or loss, alteration or destruction of data that should not have happened — a description under which a hacked mailbox typically falls. Article 33 of the GDPR attaches to that the condition for reporting to the supervisory authority: that reporting obligation applies when the breach poses a risk to the rights and freedoms of the individuals, with an exception if that risk is reasonably absent. The guidelines of the EDPB elaborate further on this concept of risk, and the Dutch Data Protection Authority provides on its page about data breaches a practical guide for that assessment. What is uniform across the EU: the definition and risk test from the Regulation. What differs per country is the supervisory authority where the report goes — in the Netherlands the Dutch Data Protection Authority, in other Member States the supervisory authority of that country.