If your company is only established in the Netherlands and a data breach affects Dutch data subjects, you report it as you normally would: to the Dutch Data Protection Authority. If your company also has a branch in another EU country, or if the breach affects data subjects in multiple Member States, the GDPR provides a separate mechanism: the one-stop-shop principle. Under this principle, the regulation designates one supervisory authority to coordinate the case, even though multiple countries are involved.
This single, coordinating supervisory authority is called the lead supervisory authority. As a rule, this is the supervisory authority of the country where your main establishment is located: the place where the main decisions about the purposes and means of processing are made. The 72-hour deadline to report does not change, even if multiple countries are involved — this deadline is fixed in the GDPR itself and applies across the EU.
When is a data breach cross-border
A data breach is cross-border once the processing to which the breach relates takes place in the context of activities of establishments in more than one Member State, or when the breach substantially affects data subjects in multiple Member States. The latter is not the same as "we also have customers abroad": it concerns whether the processing itself is organised across borders, for example because an establishment in another country helps decide how the data is handled. A webshop that sells from the Netherlands to customers in Germany without a German establishment generally does not fall under this.
The one-stop-shop principle in practice
The idea behind the one-stop-shop principle is that a company with establishments in multiple Member States does not have to deal separately with every national supervisory authority. The lead supervisory authority takes the initiative, coordinates with the supervisory authorities of the other countries involved, and ensures one decision instead of several, possibly contradictory, ones. For you as a company, this mainly means you know who to contact: the supervisory authority of your main establishment, not the one in each country where a data subject lives.
The EDPB has published guidelines on how a main establishment is determined and how supervisory authorities work together. These guidelines are relevant once your company is actually active in multiple countries with its own establishments, not simply because you have international customers.
What stays the same, where is the difference
The core of the reporting obligation — when a breach is reportable, the 72-hour deadline, and whether data subjects themselves must be informed — is set out in the GDPR and applies in the same way in every Member State. What can differ is practical in nature: each national supervisory authority's reporting portal works slightly differently, some countries use their own language for the report, and determining a lead supervisory authority sometimes requires further investigation if it is not immediately clear which establishment is the main establishment. This latter point is one of the issues on which EU Member States may differ in implementation practice, even though the underlying rule is the same.
For an SME without an overseas branch
Most SMEs and self-employed professionals do not have their own establishment abroad, even if they do have customers or suppliers across the border. In that case, very little changes in practice: you report a personal data breach simply to the Dutch Authority for Data Protection, in the same manner and within the same time limit as a breach that only affects Dutch data subjects. If you are unsure whether your situation nonetheless has a cross-border character—for example, because you have a subsidiary in another EU member state that co-decides on the processing—that is a question best discussed with a lawyer or directly with the Dutch Authority for Data Protection. With the decision tree in a few questions see whether something is a reportable personal data breach you get a first indication, even if you are not yet sure whether there is a cross-border aspect to it.
To see how such a report relates to your processing register and arrangements with suppliers, it is useful to look more broadly than just the reporting obligation. The knowledge base with explanations by topic brings together the various obligations, and an explanation of where the information comes from shows which sources lie behind each answer, including the guidelines of the EDPB.
Do you have questions about your own situation, for example because you are unsure whether your establishment abroad counts as a main establishment? Then take the free quick-scan or browse through the frequently asked questions about data breaches and the reporting obligation to see which question comes closest to your situation. For a definitive assessment of your own case, a lawyer or the Dutch Authority for Data Protection remains the appropriate point of contact.