Is this a data breach and do I need to report it?
As an entrepreneur, you're responsible for the personal data of your customers and employees. Under the GDPR, you're then called the data controller. Here you can read when something is a data breach, when you have to report it, and what to do right away. This is general explanation and not legal advice; if in doubt, check the website of the Dutch Data Protection Authority (AP) or consult a lawyer.
What is a data breach?
According to the GDPR, the European privacy law, it's a breach of security that leads to personal data being lost, destroyed, altered, or ending up with someone who isn't allowed to have it (article 4, point 12). Personal data is data about an identifiable person, such as a name, email address, address, or order history. So it's not just about hackers. Examples:
- an email or attachment with personal data sent to the wrong recipient;
- a lost or stolen laptop, phone, or USB stick with personal data that wasn't encrypted;
- a hacked mailbox containing invoices, quotes, or job applications;
- a website or webshop from which customer data has been stolen;
- ransomware that blocks you from accessing your customer records, even if nothing was copied.
The first steps
- Stop the leak. Ask the wrong recipient to delete the email and confirm this. Change the password of a compromised mailbox from a device you trust (see Secure passwords and what to do if a password is leaked).
- Map out what happened. What's the cause, when did it start, what data is involved, how many people, who can access it, and was the data encrypted? Write everything down, with date and time.
- Assess the risk for the people whose data is involved (see below).
- Report it to the AP if necessary, within 72 hours.
- Inform those affected if the risk to them is high.
- Record it in your data breach register. You always do this.
Do I need to report it to the Dutch Data Protection Authority?
You report a data breach without undue delay and, if possible, within 72 hours after you discover it. This isn't necessary if it's unlikely to pose a risk to the people whose data is involved (article 33 GDPR).
- The clock starts when you find out, not when the breach occurred. Weekends count: if you discover it on Friday at 16:40, you must report it by Monday at 16:40 at the latest.
- Incomplete reporting is allowed. If you don't know everything yet after 72 hours, report with what you know and add to the report later.
- Online only. You report via the AP's report form, not by phone, email, or post. The AP's questionnaire helps you prepare the report.
- Not sure? The AP recommends reporting anyway.
These questions help with the assessment:
| Question | Lower risk | Higher risk |
|---|---|---|
| What data? | Only business contact details | National ID number, copy of ID document, bank details, passwords, medical data, children's data |
| How many people? | One or a few | Many |
| Readable by whoever has it? | Well encrypted, the key wasn't leaked | Readable, or the password was also leaked |
| Who has it? | A known recipient who confirms they've deleted it | An unknown party, a criminal, or publicly on the internet |
For example: if a well-encrypted laptop is stolen, there's probably no risk. Reporting isn't necessary then, but you do record it in your register. On an unencrypted laptop, the finder can read everything; then there's usually a risk.
When do you inform those affected?
If the breach is likely to pose a high risk to the people whose data is involved, you inform them without delay (article 34 GDPR). Explain in plain language what happened, what the consequences might be, what you're doing, and what they can do themselves, such as changing a password or watching out for phishing in your name.
This isn't necessary if the data was unreadable due to good encryption, or if you've since taken measures that make the high risk no longer likely. If it takes disproportionate effort to reach everyone, you make a public announcement instead.
The data breach register: always keep it up to date
You record every data breach, even if you don't report it (article 33, paragraph 5). Note the facts, the consequences, the measures, and your assessment: why you did or didn't report it, and why you did or didn't inform those affected. The AP has a sample data breach register.
And if the breach is with a supplier?
Your hosting company, your cloud accounting software, or your newsletter service is, under the GDPR, a processor: a party that processes personal data on your behalf. A processor must inform you without undue delay if they discover a data breach (article 33, paragraph 2). After that, you assess whether you need to report it, and in principle you also report it yourself.
This also applies if WebOké is your processor. Do you think the breach is on our end, for example on our servers? Then contact us right away via a ticket in the Support Center, with what you've seen and when.
Further reading
- WebOké Backups: viewing, restoring, or downloading a backup
- Dutch Data Protection Authority: whether or not to report
- Dutch Data Protection Authority: how to report a data breach
- Dutch Data Protection Authority: report form questionnaire
- Dutch Data Protection Authority: sample data breach register
- The GDPR, articles 4, 33, and 34 (EUR-Lex)