NetherlandsGDPR Articles 33-34 and UAVG Article 42, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the AP without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Netherlands, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, subject to UAVG Article 42's national exception.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
These lines are LexLint's reading of the law's text. Also read by: Autoriteit Persoonsgegevens (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.autoriteitpersoonsgegevens.nl/en/themes/security/data-breaches/reporting-or-not-reporting-a-data-breach
- Guidance body
- Autoriteit Persoonsgegevens
- Open questions
- Which controllers are 'financiële ondernemingen als bedoeld in de Wet op het financieel toezicht' (financial undertakings within the meaning of the Financial Supervision Act) for the purpose of Article 42 of the UAVG, which disapplies GDPR Article 34 for them?
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified; Article 33(5) names the facts, the effects and the remedial action but no fixed log fields, and says the documentation must let the supervisory authority verify compliance with the Article. UAVG Article 42 only disapplies Article 34 for financial undertakings and leaves Article 33(5) in place.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5)
- Trigger
- security_incident
What this law does
A controller must notify the AP without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.
UAVG Article 42 adds one national exception to the Article 34 individual-notification duty: it disapplies Article 34 for financial undertakings within the meaning of the Wet op het financieel toezicht (Financial Supervision Act).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .