The core: the breach notification obligation itself does not change
The breach notification obligation in case of a data breach is set out in the GDPR itself, with the well-known deadline of 72 hours after discovery to the Data Protection Authority, and a separate assessment of whether the data subjects themselves must also be informed. This text is part of a European regulation and does not change every year. As far as is currently known, there is no change to the regulation itself this year that affects the notification obligation or the deadline. What does change is the guidance around it: how the EDPB and the Data Protection Authority interpret the open standards in the law, and how other legislation sits alongside the GDPR. For an SME, this is often more relevant than the statutory text itself, because it is precisely this guidance that determines when an incident is considered notifiable.
So it is not about a new date or a new article number to remember, but about three shifts that affect practice: stricter guidelines on what counts as a data breach, more overlap with sector-specific legislation such as NIS2, and a different reality because incidents increasingly occur with a SaaS provider rather than with the company itself.
Guidelines that shift the boundary
The GDPR itself describes a data breach in general terms: a breach of security that leads to destruction, loss, alteration or unlawful disclosure of personal data. What concretely falls under this is filled in year after year by guidelines from the EDPB and the Data Protection Authority's own interpretation. Over the years, there has been increasing clarity on borderline cases: a misdirected email with an attachment, an employee logging into the wrong account, or a backup that is temporarily unavailable. Such situations were previously more often treated as an internal matter; the line in the guidelines is that even without any wrongdoing on the part of an employee, there can be a notifiable incident. For a director or office manager, this means that the assessment can less often be based on gut feeling and more often on a fixed procedure. Anyone in doubt as to whether a specific incident falls under the notification obligation can have it worked through in a few questions via the decision tree at gdpria.eu, in a few questions see whether something is a notifiable data breach.
Overlap with other legislation
A second shift is not in the GDPR itself, but in legislation that sits alongside it. For organisations that are part of, or supply to, sectors covered by legislation such as NIS2, a security incident may be subject to two notification regimes at the same time: the GDPR for personal data, and a sector-specific notification obligation for the service itself. This does not affect every SME, but it does affect installation companies, IT service providers and other parties who act as suppliers to a larger, regulated organisation. It is advisable for this group to check whether a client or principal has added additional notification agreements to the contract in the meantime, in addition to what is already in the data processing agreement. Anyone wishing to check exactly what such an agreement says about notification deadlines and responsibilities can find background information in the knowledge base with explanations by topic.
Practice is shifting to the SaaS provider
The third change is less a matter of regulation and more of factual development: a growing share of incidents that Dutch companies face arises not within themselves, but at a software vendor they use for accounting, personnel management or customer contact. The responsibility to assess whether that constitutes a reportable data breach remains, however, with the company that has the data processed, not automatically with the vendor. A vendor that reports an incident itself does not release the client from conducting its own assessment. That makes it all the more important to establish in advance how and when a vendor reports an incident, and to also find that arrangement in your own overview of tools used. Companies that do not yet have that overview complete can build it with the help of guidance on how the system is populated from known tools.
What this means for you
For most SMEs, the statutory deadline itself does not change this year. What is sensible, however: to periodically review your own approach to incidents against the latest guidelines, check whether a client is imposing additional reporting arrangements, and clarify with vendors who assesses an incident first. None of these points calls for a legal study, but rather for a fixed moment to look into it.
Would you like to quickly see where your business stands on this point? The questions in the free quick-scan of gdpria.eu provide a first indication, and in the frequently asked questions about data breaches and reporting obligations you will find the shorter answers to related questions.