The first response must establish facts, protect people and keep business trust intact.
At 9.12 on Monday morning, an employee tells the founder that a spreadsheet went to the wrong customer. It may contain names, addresses and bank details. The recipient has not replied. The IT provider wants a support ticket. The customer whose data is involved expects a telephone call.
This is how a data breach often enters a small business. Not through a dramatic attack, but through an ordinary action that suddenly demands legal judgment, technical facts and commercial tact. The clock starts while people are still asking what happened.
Under the GDPR, a qualifying personal-data breach must be reported to the Autoriteit Persoonsgegevens within 72 hours after the controller becomes aware of it. Notification is not required where risk to people’s rights and freedoms is unlikely. Every breach must still be documented internally.
The first decision cannot wait for perfect knowledge
The law does not require a completed forensic investigation before management makes its first reporting assessment. Rijksoverheid guidance allows information to be supplied in phases when the initial facts are incomplete, provided the remaining information follows without undue delay and any delay is explained.
That distinction matters. Waiting for certainty can consume the reporting period. Reporting with basic facts can create confusion. The real discipline lies between those extremes: establish what is known, state what remains uncertain, contain the event and retain the reasoning behind each decision.
Two separate questions then follow. Reporting to the regulator depends on the likely risk to affected people. Communicating directly with those people uses the higher threshold of likely high risk. One decision does not automatically answer the other.
I read the 72-hour period as an ownership test. Who has authority to assess the event? Who can obtain access logs? Who contacts the software supplier? Who speaks to the client? Who records why management reported, or why it concluded that reporting was unnecessary?
Outsourcing IT does not outsource responsibility
The founder in our Monday morning scene may have a capable IT provider. That provider can block an account, retrieve logs or confirm whether a device was encrypted. It cannot automatically take over the company’s legal role or its relationship with customers.
The distinction between controller and processor becomes concrete here. A controller determines why and how personal data is processed. A processor handles it on the controller’s behalf. A small payroll provider, web agency or adviser may process client data while acting as controller for its own employees and sales contacts.
One incident can therefore create several routes. The processor must inform its client without unreasonable delay. The client may then assess notification to the Autoriteit Persoonsgegevens. Contracts may impose shorter escalation periods or require specific evidence. Management must know which role the company holds for each affected data set.
This is where compliance meets cash. Staff stop billable work to reconstruct events. External specialists may be needed. Invoices wait while clients ask questions. Renewal discussions become harder if the company cannot explain which systems were involved, which subcontractors had access and what was done to limit harm.
The ordinary incident deserves serious attention
CBS recorded 37,800 breach notifications to the Autoriteit Persoonsgegevens in 2024, up from 25,700 in 2023. Those figures count notifications, not necessarily separate incidents, because comparable events may be reported together. They still show the scale of the administrative response around personal-data failures.
The wider cyber picture is more ordinary than the popular image of an expert hacker. In the CBS survey covering 2024, 23 percent of businesses with at least two workers reported phishing or spoofing. Only 1 percent reported externally caused data breach or manipulation.
A suspicious payment email, compromised mailbox or supplier account may therefore be the opening scene. The privacy question appears later, when the business discovers that personal data was accessed, changed, disclosed or made unavailable.
Small firms also tend to have fewer layers of protection. In 2025, 13 percent of businesses with two to ten workers had implemented at least ten of twelve cybersecurity measures surveyed by CBS. Among businesses with at least 250 workers, the figure was 86 percent. This measure concerns general resilience rather than legal compliance. It shows how unevenly businesses can absorb pressure.
AI makes the supplier chain less visible
The same control question now reaches everyday AI use. CBS reported that 13.8 percent of microbusinesses with two to nine workers used at least one measured AI technology in 2025. Among AI-using microbusinesses, commercial software was the most common route.
The exposure may sit inside a marketing, administration or customer-service application that staff already use. Entering personal data into an AI tool is processing. The relevant questions are concrete: what information entered the tool, under whose account, for what purpose, and under which supplier terms?
Back at the Monday meeting, the strongest company is not necessarily the one with the largest security budget. It is the one that can quickly identify the data, system, recipient, client and decision owner. Its incident register records what happened, the likely consequences, the containment steps and the reasoning behind external communication.
A useful rehearsal starts with the first hour. Can someone preserve evidence before accounts are reset? Is there cover when the usual decision-maker is absent? Can the company reach its cloud, payroll and IT suppliers quickly? Do staff know one clear route for reporting a lost device, wrong email or suspicious login?
Dutch business is moving toward a simple expectation: when something fails, management must still give a reliable account of itself. The 72-hour clock is part of that expectation, but the deeper issue is trust. A calm, documented response protects people, supports legal judgment and shows clients that responsibility did not disappear when certainty did.
If your business needs a clearer breach-response structure, I can help management define roles, decisions and escalation routes before the clock starts.
The data, sourcing, and analysis behind this article were conducted by Paolo Maria Pavan. AI was not used to identify sources, build the factual basis, or produce the analytical judgment contained here. AI was used only as a drafting aid. The final English text was personally reviewed, edited, and approved by Paolo Maria Pavan before publication.
