On January 29, 2019, the Dutch Data Protection Authority
(Autoriteit Persoonsgegevens, the "Dutch DPA")
published a
report (in Dutch) on the personal data breach notifications
received in 2018 (the "Report"). The EU General Data
Protection Regulation (the "GDPR") requires data
controllers to notify a personal data breach to the competent Data
Protection Authority ("DPA") within 72 hours after
becoming aware of it. In the Netherlands, this breach notification
requirement has been in place since January 1, 2016. However, the
GDPR imposed additional requirements, including: providing certain
information in a breach notification; data controllers'
mandatory obligation to notify affected individuals if the breach
is likely to result in a high risk to the rights and freedoms of
those individuals; companies duty to document any personal data
breaches.
