When and where must you report data breaches?
A data breach occurs when there is destruction, loss, alteration, or unauthorised disclosure of or access to personal data. A data breach must always be reported, unless there is little to no risk to the privacy of the data subjects.
Reporting a data breach
You must report the breach as soon as possible to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), and no later than within 72 hours of discovery. You can do this via the AP data breach reporting portal. If there is a high risk to privacy, you must also report the data breach to the data subject.
If you fail to report a data breach or report it too late, the AP may impose fines.
What does Laposta do in the event of a data breach?
The data processing agreement states that Laposta, as the processor, will inform you of a potential data breach within 24 hours. You then have 48 hours left to submit the report to the AP.
On the page Complying with the GDPR, you can read what else you need to take into account.