What to Do After a Data Breach: The Complete Step-by-Step Plan for SMEs

What to Do After a Data Breach: The Complete Step-by-Step Plan for SMEs

A data breach can happen to any business. A stolen laptop, an email containing personal data sent to the wrong person, a ransomware attack: in 2025 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) received more than 25,000 data breach notifications. Yet many SMEs don't know what to do when it actually happens. This guide gives you a complete step-by-step plan, so you can act quickly, correctly and in line with the law when the inevitable occurs.

Key takeaways (TL;DR)

• 72 hours is the legal deadline for reporting a data breach to the Dutch Data Protection Authority (AP). Missing it leads to fines.
• Not every data breach has to be reported, but you must always record it in your data breach register.
• The average cost of a data breach for SMEs is €95,000-165,000, including fines, recovery and reputational damage.
• GDPR fines can reach €20 million or 4% of annual turnover. In practice, fines for SMEs range from €5,000 to €830,000.
• A data breach response plan halves the average recovery time and cuts total costs by 30-40%.
• NIS2 adds reporting obligations that go further than the GDPR requirements.
• 80% of data breaches are preventable with basic measures such as MFA, encryption and awareness training.

What Is a Data Breach Under the GDPR?

Under the GDPR, a data breach is any security incident that leads to the destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, personal data. It's not just about hackers and cyberattacks.

Examples of data breaches:

• A laptop containing customer data is stolen
• An email containing personal data is sent to the wrong recipient
• Ransomware encrypts systems that hold personal data
• An employee loses a USB stick with staff data
• Cloud storage is accidentally made publicly accessible
• An old system is disposed of without being wiped and still contains data
• A paper file is thrown away without being shredded

Crucially, a data breach isn't only data leaking out. Losing access to data (for example through ransomware) or unauthorised changes to data also count as a data breach.

The 7-Step Emergency Plan for a Data Breach

When you discover a data breach, follow this plan. Every step is crucial and the order matters.

Step 1: Contain the damage (first minutes)

The first priority is to stop the breach and limit further damage.

Take immediate action:

• Isolate affected systems from the network
• Block compromised accounts
• Change the passwords of the systems involved
• Bring in your IT partner or managed security provider

In the event of a cyberattack:

• Disconnect affected devices from the network, but don't switch them off (to preserve evidence)
• Activate your disaster recovery plan
• Bring in your incident response partner if needed

In the event of a physical breach (stolen device):

• Wipe the device remotely using MDM tooling
• Check whether the hard drive was encrypted
• Block all accounts that were signed in on the device

Step 2: Establish the scope (first hours)

You need to determine quickly and accurately what exactly happened.

Answer these questions:

• Which personal data is involved? (names, addresses, citizen service numbers (BSN), financial data?)
• How many people are affected?
• How did the breach happen? (technical failure, human error, attack?)
• Was the data viewed, copied or destroyed?
• Has the breach been stopped or is it still ongoing?
• Was the data encrypted?

Document everything: times, actions, findings. You'll need this for the notification and possibly for the Dutch Data Protection Authority.

Step 3: Assess the duty to report (within 24 hours)

Not every data breach has to be reported to the AP, but you must always assess it. The main rule: if the breach poses a risk to the rights and freedoms of the people concerned, you must report it.

You must report to the AP if:

• Sensitive personal data is involved (medical, criminal, BSN, financial)
• The data wasn't encrypted
• A large number of people are affected
• The data could be misused for identity fraud
• A cyberattack is involved

You may not need to report if:

• The data was protected with strong encryption and the key hasn't been compromised
• The breach was limited to a small, clearly defined set of data
• The data hasn't been viewed by third parties

In doubt? Report it. The AP is more lenient towards businesses that report proactively than towards those that try to avoid reporting.

Step 4: Notify the Dutch Data Protection Authority (within 72 hours)

Once you've established that the breach must be reported, you have to notify the AP within 72 hours of discovering it. You do this using the notification form on the AP's website.

The notification must include at least:

• A description of the nature of the breach
• The categories and approximate number of people affected
• The categories and approximate number of personal data records affected
• The name and contact details of the Data Protection Officer (DPO) or contact person
• A description of the likely consequences
• A description of the measures taken and proposed

You don't need to have all the information complete straight away. An initial notification with the facts available is enough. You can add to it later.

Step 5: Inform the people affected (if necessary)

If the breach is likely to pose a high risk to the people concerned, you must also inform them directly. This is mandatory where there is:

• A risk of identity fraud
• Financial loss
• Discrimination
• Reputational damage for the person concerned
• Loss of confidentiality protected by professional secrecy

Your communication to those affected should cover:

• In plain language: what happened?
• Which data is involved?
• What are the possible consequences?
• What measures have you taken?
• What can they do to protect themselves?
• Contact details for questions

Be honest, specific and empathetic. Don't try to play it down.

Step 6: Record it in the data breach register (always)

The GDPR requires every business to keep a data breach register. Every breach must be recorded in it, including breaches that don't have to be reported to the AP.

For each incident, the register includes:

• Date and time of discovery
• A description of the breach
• The data affected and the number of people concerned
• The risk assessment
• The measures taken
• Whether the AP and/or the people concerned were notified
• Your reasoning if you decided not to report

The AP can request this register during an inspection. A well-kept register shows that you take data protection seriously.

Step 7: Evaluate and improve (after the incident)

Every data breach is an opportunity to learn. Carry out a thorough evaluation after the incident.

Evaluation questions:

• How did the breach happen, and could it have been prevented?
• Did we respond quickly enough? Where were the delays?
• Was the emergency plan effective? What needs to change?
• Which technical or organisational measures need strengthening?
• Is additional training needed?

Document the lessons learned and update your security policy and emergency plan.

Prevention: How to Avoid Data Breaches

Prevention is always better than cure. These measures drastically reduce the risk of a data breach.

Technical measures

MFA (multi-factor authentication) is the single most effective measure. It blocks 99.9% of automated attacks on accounts.

Data encryption on laptops, mobile devices and USB sticks ensures that stolen or lost devices don't cause a data breach, provided the encryption key hasn't been compromised.

Email security with DLP (Data Loss Prevention) rules stops employees from accidentally sending sensitive data by email.

Patch management prevents known vulnerabilities from being exploited. Proactive managed IT keeps all your systems up to date.

Backup and disaster recovery make sure you can recover quickly from ransomware or data loss without paying a ransom.

Organisational measures

Awareness training for all employees on recognising phishing, handling data safely and reporting incidents.

Access management based on the need-to-know principle. Zero trust: give employees access only to the data they need for their role.

A clear desk and clear screen policy prevents sensitive information from being physically accessible.

Data processing agreements with every party that processes personal data on behalf of your organisation.

NIS2 and the Duty to Report

The NIS2 Directive, which takes effect in the Netherlands in mid-2026, adds further reporting obligations on top of the GDPR requirements.

NIS2 requires:

• An early warning within 24 hours of detecting a significant incident
• An incident notification within 72 hours with an initial assessment
• A final report within 1 month with a detailed description, root cause analysis and the measures taken

This applies to organisations classified as essential or important under NIS2, including their suppliers.

Frequently Asked Questions

Do I have to report every data breach to the Dutch Data Protection Authority?

No, only breaches that pose a risk to the rights and freedoms of the people concerned. However, you must document every data breach, including those you don't have to report, in your internal data breach register. If in doubt, report it. The AP looks favourably on organisations that report proactively.

What are the fines if I don't report a data breach?

The GDPR allows fines of up to €20 million or 4% of annual turnover. In practice, fines for SMEs in the Netherlands are lower, but they are rising. The AP has imposed fines of between €5,000 and €830,000 for failing to report data breaches, or reporting them too late.

How quickly do I need to act after a data breach?

Immediately. The 72-hour reporting window starts the moment you discover the breach. But regardless of the notification, you want to contain the damage as quickly as possible. Every hour a breach stays open increases the potential damage.

Should I report it to the police?

For cybercrime (ransomware, hacking, phishing), filing a police report is strongly recommended. It isn't mandatory, but it helps track down the perpetrators and may be required by your insurer. If devices have been stolen, reporting it to the police is sensible in any case.

What if I don't know whether personal data has been leaked?

If you can't rule out that personal data is involved, treat it as a data breach. Investigate as quickly as possible and document your findings. Better to report one breach too many than one too few.

Can I take out cyber insurance to cover the consequences?

Yes. Cyber insurance often covers the costs of incident response, legal assistance, communication with the people affected and sometimes even fines. The premium depends on your level of security. Many insurers require at least MFA and a backup strategy.

Make Sure You're Prepared

A data breach will happen to you. The question is not if, but when. The difference between a manageable incident and a business crisis lies in preparation.

At TRON Group we help SMEs draw up a data breach response plan, put preventive measures in place and respond quickly when things go wrong. From managed security to incident response: we're there when it matters.

Want to know how well prepared your organisation is for a data breach? Get in touch for a no-obligation chat or call us directly on +31 85 303 5869. Together, we'll make sure you're ready.