Responsabilità per violazione dei dati nei Paesi Bassi: di chi è la responsabilità?

After a data breach in the Netherlands, the organisation that decides why and how the personal data is processed (the controller) is primarily responsible, both towards the Dutch Data Protection Authority and towards the people affected. The exception: a processor that acted outside the controller’s instructions or failed its own security duties is liable too, and an attacker who broke in deliberately commits a criminal offence.

Responsibility plays out on three levels: regulatory fines and orders, civil claims for damages, and duties under the Cybersecurity Act (Cyberbeveiligingswet) for designated organisations. This page explains each level, the notification deadlines and what you can do.

Which laws apply after a data breach?

The General Data Protection Regulation (GDPR) for personal data, and the Cybersecurity Act for designated essential and important entities, whether or not personal data is involved.

The Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG) supplements the GDPR and designates the Autoriteit Persoonsgegevens (AP) as supervisory authority. See our guide to il regolamento generale sulla protezione dei dati and our page on the Autorità olandese per la protezione dei dati.

The Cybersecurity Act implements the EU NIS2 directive and entered into force on 15 August 2026, together with the Cybersecurity Decree (Cyberbeveiligingsbesluit). It replaced the Network and Information Systems Security Act (Wbni), so references to the Wbni in contracts and policies are outdated. The Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten) covers physical resilience of designated critical entities. More in our article on NIS2 e la legge olandese sulla sicurezza informatica.

Who is responsible: controller, processor or supplier?

The controller is responsible for the security of the processing and for notifying the breach. A processor, such as a hosting or cloud provider, must follow the controller’s instructions, take its own security measures and inform the controller of a breach without undue delay.

• controller: answers to the AP and the data subjects, also for breaches at its processors.
• Processore: liable for its own failures and for acting outside instructions.
• Sub-processors and suppliers: responsibility follows the processing agreement and the contract chain.
• L'attaccante: deliberate and unlawful intrusion into a computer system is computer trespass (computervredebreuk) under Article 138ab of the Dutch Criminal Code, punishable by up to two years’ imprisonment.

Where both controller and processor failed, the AP can act against both. A controller cannot hand over its responsibility by outsourcing; it must check its suppliers’ security and lay down security and notification duties in the processing agreement. See our article on Ruoli del titolare e del responsabile del trattamento ai sensi del GDPR.

Quando è necessario segnalare una violazione dei dati?

To the AP without undue delay and, where possible, within 72 hours after you became aware of it, unless the breach is unlikely to create a risk for the people concerned. The clock starts when you learn of the breach, not when it happened.

The report describes the nature of the breach, the categories and approximate number of people and records involved, the likely consequences and the measures taken, plus a contact point such as the data protection officer. If not everything is known within 72 hours, you may report in stages and explain the delay. Record every breach internally, including those you do not report.

When must you inform the people affected?

When the breach is likely to create a high risk for them, without undue delay and in clear language. That is not required if the data was made unintelligible, for example by encryption, if later measures remove the high risk, or if individual notice would take disproportionate effort, in which case a public announcement is needed.

Which other reports may be required?

Essential and important entities under the Cybersecurity Act must report a significant incident to their sector supervisor and the computer security incident response team (CSIRT) with an early warning within 24 hours and a fuller notification within 72 hours, even if no personal data is involved. Sector rules, for example for telecom providers, financial institutions and healthcare, can add further reports. One incident can therefore require several notifications.

What sanctions can the regulators impose?

The AP can impose fines, orders subject to a penalty payment and processing bans. For the most serious GDPR breaches the maximum fine is a fixed amount or a percentage of worldwide annual turnover, whichever is higher; the AP sets the actual amount based on, among other things, the nature and duration of the breach, the number of people affected and your cooperation.

Under the Cybersecurity Act, supervision is organised by sector. For the sectors of the Ministry of Economic Affairs, such as digital infrastructure, the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) supervises; other ministries have designated their own supervisors. They can give binding instructions and impose fines, with higher maximums for essential than for important entities.

Come si contesta una multa?

Through objection (bezwaar) to the authority that took the decision, within six weeks (Article 6:7 of the General Administrative Law Act, Awb), then appeal to the district court and higher appeal. Which appeal court is competent depends on the Act under which the decision was taken, so check that early. Corrective orders usually remain in force during the objection. See also our article on come presentare ricorso contro le decisioni legali.

Can people affected by a breach claim damages?

Yes. The GDPR gives anyone who suffers material or non-material damage from an infringement a right to compensation from the controller or processor. The claimant must show the infringement, the damage and the causal link; the mere breach of the rules is not enough for non-material damage.

Where several parties are responsible for the same damage, each can be held liable for the whole and then recover the share of the others. Claims can also be brought collectively: under Article 3:305a of the Dutch Civil Code (BW) a foundation or association can bring a collective action for a group with similar interests, and several such actions over data breaches have been brought. A complaint to the AP is free and runs separately from a damages claim.

How do you limit your liability before a breach?

By being able to show that your security was appropriate to the risk and that you acted quickly. The AP and the courts assess what you had in place, not what you intended.

• Document a risk assessment and the technical and organisational measures that follow from it: access control, multi-factor authentication, encryption, logging and back-ups.
• Have an incident response plan that names who decides on notifications within 24 and 72 hours.
• Conclude processing agreements that set security duties, breach notification within a fixed number of hours, audit rights and liability.
• Check whether you fall under the Cybersecurity Act and, if so, whether you are registered.
• Train staff on phishing and data handling, and make the board responsible for cybersecurity risk management.

Paying a ransom does not remove any of these duties and raises its own legal questions, including sanctions law. See also our article on Crimini informatici e hacking nei Paesi Bassi.

Cosa dovresti controllare in qualità di controller?

• Whether you can assess and, if required, report a breach to the AP within 72 hours.
• Whether you have a processing agreement with every processor, including breach notification and security duties.
• Whether your breach register records every breach, also those not reported.
• Whether you fall under the Cybersecurity Act and know your sector supervisor.
• Whether your insurance covers cyber incidents, regulatory investigations and claims.

What should you check as a processor or IT supplier?

• Whether you inform your customers of a breach without undue delay, as the processing agreement requires.
• Whether you process data only on documented instructions.
• Whether your liability towards customers is capped and how the cap relates to GDPR fines and claims.
• Whether you use sub-processors with the customer’s approval and on the same terms.
• Whether you are yourself an essential or important entity under the Cybersecurity Act.

What can we do for you with a data breach?

Avvocati informatici advise controllers, processors and suppliers before and after an incident.

• We assess within hours whether a breach must be reported to the AP and to the people affected, and draft the notifications.
• We determine whether the Cybersecurity Act applies and which supervisor you report to.
• We review and negotiate processing agreements and liability clauses in IT contracts.
• We draft the objection against a fine or order and conduct the appeal.
• We defend or bring damages claims after a breach, including collective actions.

Sintesi

• The controller is primarily responsible; a processor is liable for its own failures and for acting outside instructions.
• Report a breach to the AP without undue delay and where possible within 72 hours; inform those affected if the risk is high.
• Under the Cybersecurity Act, in force since 15 August 2026, significant incidents must be reported within 24 and 72 hours.
• Fines can be challenged by objection within six weeks (Article 6:7 Awb).
• People affected can claim damages, individually or through a collective action under Article 3:305a BW.

Domande frequenti