Answering questions about a data breach in the Netherlands in 2026: the notification rules

Written by Ward Peeters · Revised 1 September 2026 · 6 min read

What must a spokesperson report about a data breach to the Dutch authority?

A data breach in the Netherlands in 2026 falls under the General Data Protection Regulation (GDPR) as implemented in the Dutch Implementation Act. The spokesperson must notify the Autoriteit Persoonsgegevens (AP) if the breach is likely to result in a risk to the rights and freedoms of natural persons. That risk includes loss of control over personal data, discrimination, identity theft, financial loss, or damage to reputation.

The rule covers any breach that exposes personal data, not just leaks of sensitive information like medical or financial records. The PR-Dashboard product pages, read 1 September 2026, do not mention a specific setup fee for data breach reporting, but the Dutch law itself sets the standard: notification within 72 hours of discovery.

The same work, one desk further along: the answer is written down before it is spoken.

How quickly must a Dutch organisation report a data breach in 2026?

The GDPR, which applies in the Netherlands, gives a spokesperson 72 hours to notify the AP after becoming aware of the breach. This 72 hour window starts from the moment the organisation knows or should reasonably have known about the incident. Delays happen when the breach is discovered during a weekend or holiday, but the clock does not pause.

For example, if De Perslijst from PR-Dashboard (EUR 2,650 per year for two logins, measured 1 September 2026) experienced a leak of journalist contact details, the organisation running the database would have to count the hours from that moment. Notifying the AP late without a justified reason can result in a fine of up to 2 percent of annual global turnover, whichever is higher.

When does a spokesperson need to inform the people affected by a data breach?

Dutch law requires the organisation to communicate the breach directly to the affected individuals when the breach is likely to result in a high risk to their rights and freedoms. A high risk means the data exposed could lead to identity theft, fraud, or physical harm. The communication must describe the nature of the breach, the contact details of the data protection officer, the likely consequences, and the measures taken to address the breach.

For example, if Persvragen from the supplier (EUR 2,700, no period stated, measured 1 September 2026) leaked contact details of journalists who had submitted questions, those journalists would need to be told. The message must be in clear and plain language, which in the Netherlands means Dutch unless the affected persons are known to use another language.

What are the key differences between reporting to the AP and making a public statement?

Reporting a breach to the AP is a legal obligation; making a public statement is a communication choice. The AP notification is a confidential report that includes details about the breach, the categories of data involved, the number of affected individuals, and the measures taken. A public statement, on the other hand, is for the media, customers, or the general public, and it aims to manage reputation and provide reassurance.

A spokesperson should not copy the AP report word for word into a press release because the AP report contains operational details that could worsen the situation if made public. Tools such as the newsroom product from the Amsterdam supplier (EUR 1,750, no period stated, measured 1 September 2026) can help publish a controlled statement on the organisation's own domain, but the content must be separate from the legal notification.

The rule is: report fully to the AP, communicate clearly to the public, but do not mix the two documents.

How do Dutch data breach rules compare to what other PR platforms document?

The Dutch rules follow the GDPR, which is a European regulation, so the obligations are similar across EU countries. What differs is how each national authority enforces them and whether local guidelines exist. PR platforms that serve Dutch organisations may document data breach support differently.

For example, Mynewsdesk, measured 31 August 2026, publishes no public price for a breach reporting feature and has no Dutch language pages. Prezly, measured 31 August 2026, publishes prices from EUR 100 to 250 per month but hosts on AWS eu-west-1 in Dublin, which means Irish data protection rules would apply to that hosting, not Dutch. The supplier states that all development and hosting take place in the Netherlands with Dutch programmers, measured 1 September 2026, which places the data handling under the same jurisdiction as the Dutch AP.

That alignment simplifies compliance because the data stays within the same legal framework.

Which comparisons show the cost of handling data breach communication in the Netherlands?

The cost per user per year for a journalist database or newsroom tool does not directly cover data breach handling, but the infrastructure costs matter. The Amsterdam database costs EUR 2,650 per year for two logins, which works out to EUR 1,325 per user per year. Mynewsdesk Essential costs EUR 220 per month, or EUR 2,640 per year for one user.

Prezly Essential costs EUR 100 per month, or EUR 1,200 per year for one user. The lowest published price per user per year among these is Prezly Essential at EUR 1,200. However, Prezly does not document a Dutch data location on its pricing page measured 31 August 2026.

The Amsterdam supplier states its hosting is in the Netherlands, measured 1 September 2026. The comparison table below sorts by cost per user per year ascending, showing what each published amount buys.

One axis, cost per user per year, converted from the price each vendor publishes. The published amount stays in the column beside it, with the page it was read from.

Wide table. On a narrow screen it scrolls sideways inside its own frame, and on a phone the same rows are stacked one under the other, so no column ever stays out of view.

What should a spokesperson check before using a PR tool for breach communication?

A spokesperson should verify three things before relying on a PR tool during a data breach. First, where is the data stored? If the tool hosts data outside the Netherlands, the breach notification might involve a different supervisory authority.

Second, does the tool have a documented process for handling urgent communications, such as publishing to a newsroom within minutes? Third, does the tool integrate with legal or compliance systems for incident reporting? The platform offers single sign on with LexisNexis, Monalyse and Media Info Groep, as documented on its product pages, measured 1 September 2026.

That integration could help a spokesperson combine legal research with media outreach. The key is to prepare the tool and the process before a breach happens, because the 72 hour clock starts immediately.

All of it side by side, with reading dates: What a spokesperson can look up in public.