After a cyberattack, the organisation that was hit must assess within 72 hours whether it has to notify a personal data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), under Article 33 of the General Data Protection Regulation (GDPR). People whose data leaked can claim compensation under Article 82 GDPR, but only if they show an infringement, actual damage and a causal link; a leak alone is not enough.
Who can claim from whom depends on your position. The organisation that was hit usually looks to its IT supplier under the contract, while customers, employees and patients can rely directly on the GDPR. This article explains the notification duties, the right to compensation, the liability of suppliers, the criminal law route and the role of cyber insurance.
Table of contents
Who counts as a victim of a cyberattack?
There are three groups of victims, and each has a different legal basis for a claim. The group you belong to decides whether you rely on a contract, on tort under Article 6:162 of the Dutch Civil Code (BW), or on Article 82 GDPR.
- The organisation that was hit: system downtime, lost turnover, recovery costs, forensic investigation and reputational harm.
- Data subjects: customers, employees or patients whose personal data were exposed, with financial loss or non-material damage such as fear of identity fraud.
- Third parties in the supply chain: companies that depend on a supplier whose systems went down.
When must you notify a data breach?
You must notify a personal data breach to the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The only exception under Article 33 GDPR is a breach that is unlikely to result in a risk to the rights and freedoms of individuals.
Article 34 GDPR adds a second duty: you must inform the data subjects themselves if the breach is likely to result in a high risk to them. You may skip this if the data were encrypted, if later measures remove the high risk, or if individual messages would take disproportionate effort; in that last case a public announcement is required instead.
To make these assessments, you need to know which data were affected and whether they were actually taken. An independent forensic investigation usually gives that answer. If the attack hit your processor rather than your own systems, you depend on the processor for this information.
Can you force a hacked supplier to give you information?
Yes, if your data processing agreement provides for it. In Blauw Research v. Nebu (District Court of Rotterdam, 6 April 2023, ECLI:NL:RBROT:2023:2931) the interim relief judge (voorzieningenrechter) ordered the hacked processor to provide all available information within two working days and to commission an independent forensic investigation within five working days, under a penalty of €25,000 per day.
The judge based these orders on the incident clause in the data processing agreement. Article 28 GDPR requires every controller and processor to conclude such an agreement, so the quality of that clause directly decides how quickly you get the facts you need for your own notifications.
When do you have a right to compensation?
Under Article 82(1) GDPR, anyone who suffers material or non-material damage from an infringement of the GDPR can claim compensation from the controller or the processor. You must show three things: an infringement, actual damage and a causal link between the two.
Material damage includes financial loss, recovery costs and loss caused by identity fraud. For non-material damage, the Court of Justice of the European Union held in Österreichische Post (4 May 2023, C-300/21) that there is no threshold of seriousness, but that an infringement on its own does not give a right to compensation.
In Natsionalna agentsia za prihodite (14 December 2023, C-340/21) the Court added that fear of future misuse of leaked data can itself be non-material damage. You must, however, show the concrete negative consequences of that fear. The Court also held that a successful attack does not by itself prove that security was inadequate, but that the controller must prove its measures were appropriate.
The GDPR claim exists alongside breach of contract and tort. Under Article 6:162 BW an unlawful act that can be attributed to the wrongdoer gives a right to compensation, provided the breached rule protects against the damage suffered (relativity, Article 6:163 BW).
Who can be held liable?
The organisation that was hit can be liable towards its customers and data subjects, and its IT supplier can be liable towards the organisation. What the supplier owed is decided first by the contract, then by the general duty of care of a good contractor.
In the case about the cyberattack on the municipality of Hof van Twente (District Court of Overijssel, 10 May 2023, ECLI:NL:RBOVE:2023:1731) the claim of almost €4 million was dismissed. The supplier had agreed to functional monitoring, not security monitoring, and the municipality had itself opened an RDP port and allowed the password “Welkom2020”. The Court of Appeal of Arnhem-Leeuwarden upheld that outcome on 25 February 2025 (ECLI:NL:GHARL:2025:1046).
The opposite result followed in O’Cliance (District Court of Amsterdam, 14 November 2018, ECLI:NL:RBAMS:2018:10124). The supplier had delivered and managed a complete IT package without a firewall or external backups, and ransomware also encrypted the backups. Because the customer had asked for simpler passwords and declined measures, the court reduced liability for contributory fault (eigen schuld): the supplier paid two thirds of €15,407.90.
The burden of proof can decide the case. In a dispute over a car dealer’s hacked email account, a hacker sent a false payment instruction and the buyer paid €26,900 to the wrong account. The Court of Appeal of Arnhem-Leeuwarden allowed the dealer to prove that its email account was appropriately secured (5 November 2024, ECLI:NL:GHARL:2024:6812) and then held that it had not done so (22 July 2025, ECLI:NL:GHARL:2025:4556). The buyer’s own contributory fault was left for a later decision.
Separately from civil claims, the Dutch Data Protection Authority can impose fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, under Article 83 GDPR. Such a fine does not depend on whether individuals suffered damage.
Can you report the attack to the police?
Yes. Hacking into a computer system is a criminal offence (computervredebreuk) under Article 138ab of the Dutch Criminal Code (Sr), and you can report it to the police. If the Public Prosecution Service (Openbaar Ministerie) prosecutes a suspect, you can join the criminal case as an injured party (benadeelde partij) and claim your damage there.
With attackers operating from abroad, detection and prosecution often fail, so the criminal route rarely replaces a civil claim. A police report is still useful in practice, because cyber insurers and supply chain partners regularly ask for one.
What does cyber insurance cover?
A cyber policy typically covers incident response, forensic investigation, data recovery, business interruption, crisis communication, third-party liability and legal costs. Whether fines, settlements or ransom payments are covered depends on the policy and on whether they are insurable at all.
Under Article 7:957 BW you must take reasonable measures to prevent or limit the damage once the incident occurs. If you do not, the insurer may reduce the payout. Policies also contain their own notification periods and often require the insurer’s consent before you engage experts or pay a ransom, so report the incident to the insurer straight away.
What should you check as an organisation that was hit?
As the organisation that was hit, you carry the notification duties and the burden of proving your security was appropriate. Check the following first.
- Has the 72-hour period under Article 33 GDPR started, and has the notification to the Dutch Data Protection Authority been made or reasoned away in writing?
- Does the breach create a high risk for data subjects, so that you must inform them under Article 34 GDPR?
- Has the cyber insurer been notified within the policy period, and has it agreed to the experts you engage?
- What does the contract or data processing agreement say about security monitoring, incident reporting and liability caps of your IT supplier?
- Are logs, backups, emails and decisions preserved, so that you can later prove your measures were appropriate?
What should you check as a data subject?
As a data subject, you must prove infringement, damage and causation yourself. Check the following before you claim.
- Which of your data were exposed: contact details only, or also financial, health or identity data?
- Did the organisation inform you, and what measures did it say it had taken?
- Can you document concrete consequences, such as fraud attempts, costs or demonstrable stress?
- Have you changed passwords and alerted your bank, so that your own conduct does not reduce your claim?
- Is the claim against the organisation that holds your data, its processor, or both?
What can we do for you with a cyberattack?
Our IT law team assists organisations and data subjects from the first hours after an incident.
- We assess within the 72-hour period whether the breach must be notified to the Dutch Data Protection Authority and to data subjects.
- We review your data processing agreement and IT contract for information rights, security duties and liability caps.
- We demand information and a forensic report from your supplier and, if needed, apply to the interim relief judge.
- We check your cyber policy for notification periods, consent requirements and exclusions.
- We assess and draft a compensation claim under Article 82 GDPR or the contract, or defend you against one.
Summary
- A personal data breach must be notified to the Dutch Data Protection Authority within 72 hours where feasible, unless it is unlikely to create a risk.
- Compensation under Article 82 GDPR requires an infringement, actual damage and a causal link; a leak alone is not enough.
- The controller must prove its security measures were appropriate; an attack by a third party does not by itself exempt it.
- An IT supplier’s liability depends on what was agreed, as the Hof van Twente and O’Cliance cases show, and contributory fault can reduce a claim.
- Notify your cyber insurer immediately and limit the damage, or the payout may be reduced.
Frequently asked questions
Within what period must I notify a data breach?
Under Article 33 GDPR you notify the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If you notify later, you must give the reasons for the delay. No notification is needed if the breach is unlikely to result in a risk to individuals.
Am I automatically entitled to compensation after a data breach?
No. Under Article 82 GDPR you must show an infringement of the GDPR, actual damage and a causal link. The Court of Justice held in C-300/21 that there is no seriousness threshold, but that an infringement alone does not give a right to compensation.
Does fear of identity fraud count as damage?
It can. In C-340/21 (14 December 2023) the Court of Justice held that fear of future misuse of leaked data can be non-material damage, provided you show its concrete negative consequences.
Is my IT supplier liable if it did not detect the attack?
That depends on what was agreed. In the Hof van Twente case (ECLI:NL:RBOVE:2023:1731, upheld on appeal) the supplier had only agreed to functional monitoring and was not liable. In O’Cliance (ECLI:NL:RBAMS:2018:10124) the supplier of a complete IT package was liable for two thirds of the loss.
Can I lose my insurance cover by acting wrongly after an attack?
Yes. Article 7:957 BW requires you to take reasonable measures to limit the damage, and the insurer may reduce the payout if you do not. Engaging experts or paying a ransom without the insurer’s consent can also affect cover under the policy terms.
