Provides telecom services, in the Netherlands

Telecommunicatiewet, Art. 11.3a · Read the law's page

• If you provide a public electronic communications service, notify the Autoriteit persoonsgegevens without delay of a security breach that adversely affects personal data processed in connection with the service in the European Union (Telecommunicatiewet Article 11.3a, paragraph 1).
• Notify the person whose personal data is concerned without delay where the breach is likely to have adverse effects on their privacy, unless the Autoriteit persoonsgegevens finds that appropriate technical protection measures made the data unintelligible to anyone without a right of access (Article 11.3a, paragraphs 2 and 5).
• Keep an overview of all personal data breaches, with at least the facts and the details that the notification contains (Article 11.3a, paragraph 6).

Besluit van 12 september 2024, Stb. 2024, 262 (Implementatiebesluit toegankelijkheidsvoorschriften elektronische communicatiediensten), op grond van art. 7a.2 en 7a.4 Telecommunicatiewet · Read the law's page

• If you provide an electronic communications service in the Netherlands and rely on the exception in Article 7a.2(4) of the Telecommunicatiewet, assess whether compliance with the accessibility requirements in Annex I, Sections III and IV(a), to Directive (EU) 2019/882 would lead to a fundamental alteration or impose a disproportionate burden (Implementatiebesluit Art. 2(1)).
• If you rely on the disproportionate-burden exception in Article 7a.2(4)(b), repeat the assessment at least once every five years, and again when the service changes or the Authority for Consumers and Markets asks for it (Art. 2(2)).
• Document the assessment, keep every relevant result for five years after the service was provided on the market, and give the Authority a copy on request (Art. 2(3)).
• Give the Authority information about your reliance on Article 7a.2(4) of the Telecommunicatiewet (Art. 2(4)).

Telecommunicatiewet hoofdstuk 7A, art. 7a.1-7a.5, ingevoegd bij Implementatiewet toegankelijkheidsvoorschriften producten en diensten (Stb. 2024, 87), art. III · Read the law's page

• If you provide an electronic communications service in the Netherlands, other than a transmission service used for machine-to-machine services, provide it only if it meets the accessibility requirements in Annex I, Sections III and IV(a), to Directive (EU) 2019/882 (Telecommunicatiewet Art. 7a.2(1)).
• Comply with Article 13 of Directive (EU) 2019/882: prepare the information Annex V requires and make it available to the public in written and oral form, including in a way accessible to persons with disabilities, keep it while the service operates, keep procedures that hold the service in conformity, take corrective measures and inform the Authority for Consumers and Markets at once of a non-conformity, and give the Authority the information it asks for (Telecommunicatiewet Art. 7a.4(1)).
• If you run an enterprise with fewer than ten employees and an annual turnover or balance sheet total of at most EUR 2,000,000, the prohibitions in Article 7a.2(1) and (2) do not apply to you (Art. 7a.2(3)).
• The competent authority under Articles 13(4) and (5) of the Directive is the Authority for Consumers and Markets (Art. 7a.3(1)).
• Service contracts concluded before 28 June 2025 may run unchanged until they expire, and at the latest until five years after that date; you may keep providing your services until 27 June 2030 using products you lawfully used before 28 June 2030 to provide similar services (Implementatiewet toegankelijkheidsvoorschriften producten en diensten, Art. VIII(1) and (2)).
• Articles 7a.2(1) and (2) do not apply to the extent that compliance would require a significant change in the service resulting in a fundamental alteration of its basic nature, or would impose a disproportionate burden on a provider that receives no outside funding, public or private, for improving accessibility (Art. 7a.2(4)); the implementing decree sets the assessment you must then carry out.