Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Must you inform your customers about a cyber incident?

Yes, as the case may be without delay: about significant incidents that can harm the service to them, and in the event of a significant cyber threat about the measures they can take themselves (Cbw 30).

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

What the act asks

An essential or important entity informs the recipients of its services, as the case may be without delay, of significant incidents that can adversely affect those services [1]. In the event of a significant cyber threat, it communicates which measures the recipients can take and, if necessary, what the threat is [1].

What that means for a carrier or logistics service provider

Determine in advance who the recipients of your services are, whom you inform, through which channel and who decides that. Also record why you do or do not inform in a specific case: the act says “as the case may be”.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Inform service recipients about relevant incidents and cyber threats. Cbw 30(1)–(2), NIS2 23(1), NIS2 23(2)

Sources

  1. [1] Cbw Art. 30 (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Recipients of services are informed about relevant significant incidents and cyber threats. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit stelt in voorkomend geval onverwijld de ontvangers van haar diensten in kennis van significante incidenten die een nadelige invloed kunnen hebben op de verlening van die diensten. 2. De essentiële entiteit of belangrijke entiteit deelt de ontvangers van haar diensten, die mogelijkerwijs door een significante cyberdreiging in relatie tot het ontvangen van die diensten worden getroffen, onverwijld mee welke maatregelen die ontvangers kunnen nemen in reactie op die dreiging. Indien nodig stelt de entiteit die ontvangers ook in kennis van de desbetreffende significante cyberdreiging.
    Source, retrieved on 2 October 2026.

Related questions

When and where do you report a significant incident under the Cbw?When is a cyber incident a significant incident?Must you also report a cyber incident as a data breach to the Autoriteit Persoonsgegevens?A customer demands that we comply with NIS2, but we are not covered by it. What now?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.