Policy Observatory
New Netherlands notification requirements will change data controllers’ view of cybersecurity
Effective 1 January 2017, Dutch data protection law requires organizations to notify the Dutch Data Protection Authority within 72 hours of “a breach of security […] which results in a significant chance of severe detrimental effects or has severe detrimental effects for the protection of the private life". The data subject must also be informed if “the breach probably will result in adverse effects on their private life”. These obligations only apply if the Dutch Data Protection Act applies, for instance in situations wherein a Dutch entity is data controller.
Country: Netherlands
Domains: Privacy
Tags: security breach, data breach notification, DPA, The Netherlands, privacy, data protection