Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Must you also report a cyber incident as a data breach to the Autoriteit Persoonsgegevens?

Often yes. If a cyber incident affects personal data, you report it as a data breach to the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the data subjects. That GDPR duty is separate from the Cbw: it also applies to an incident that is not significant and also if you are not covered by the Cbw.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Set up the Cbw duties in Trusq

Two reporting duties side by side

If you are covered by the Cbw, you report a significant incident to your CSIRT and your competent authority [3]. If personal data are affected by an incident, you also report to the Autoriteit Persoonsgegevens as controller [4]. One report does not replace the other.

Cooperation between supervisory authorities

The competent authorities cooperate with the Autoriteit Persoonsgegevens on incidents that lead to a data breach [1]. If the Cbw supervisory authority sees that an infringement may involve a data breach that must be reported, it informs the AP [2]. If the AP imposes a GDPR fine for a data breach resulting from an infringement of the duty of care or the reporting duty, the Cbw supervisory authority imposes no Cbw fine for the same conduct [7].

In practice

Have your incident procedure ask two questions for every incident: is it significant under the Cbw, and are personal data affected? A ransomware attack on your planning system holding driver and customer data can be both. If the breach lies with your TMS or cloud supplier, that supplier must inform you as processor without undue delay [5]; the report to the AP remains your task. If the risk to the data subjects is high, you also inform them [6].

Sources

  1. [1] Cbw Art. 58(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The competent authorities cooperate with the AP on incidents that lead to a data breach. Original Dutch text:
    1. De bevoegde autoriteiten werken samen met de Autoriteit persoonsgegevens bij de behandeling van incidenten die leiden tot inbreuken in verband met persoonsgegevens en wisselen in het kader van die samenwerking alle daarvoor noodzakelijke gegevens uit, waaronder persoonsgegevens.
    Source, retrieved on 2 October 2026.
  2. [2] Cbw Art. 58(2) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The Cbw supervisory authority informs the AP of a possible data breach that must be reported under GDPR Article 33. Original Dutch text:
    2. Wanneer de bevoegde autoriteit bij toezicht of handhaving er kennis van krijgt dat een overtreding van de artikelen 21, 25, 26, 27, 28, 29 of 30 door een essentiële entiteit of belangrijke entiteit een inbreuk in verband met persoonsgegevens als bedoeld in artikel 4, onderdeel 12, van de Algemene verordening gegevensbescherming kan inhouden, die op grond van artikel 33 van die verordening moet worden gemeld, stelt zij de Autoriteit persoonsgegevens dan wel de bevoegde toezichthoudende autoriteiten, bedoeld in de artikelen 55 en 56 van de Algemene verordening gegevensbescherming daarvan onverwijld in kennis.
    Source, retrieved on 2 October 2026.
  3. [3] Cbw Art. 27(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The Cbw report of a significant incident goes to the CSIRT and the competent authority. Original Dutch text:
    1. De essentiële entiteit of belangrijke entiteit dient onverwijld of, indien dat niet mogelijk is, binnen 72 uur nadat zij kennis heeft gekregen van het significante incident een melding in bij haar CSIRT en haar bevoegde autoriteit met:
    Source, retrieved on 2 October 2026.
  4. [4] GDPR Art. 33(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The controller reports a data breach without undue delay and, where feasible, within 72 hours, unless a risk is unlikely.
    1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
    Source, retrieved on 2 October 2026.
  5. [5] GDPR Art. 33(2) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The processor informs the controller.
    2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
    Source, retrieved on 2 October 2026.
  6. [6] GDPR Art. 34(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Where a high risk is likely, the data subjects are informed.
    1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
    Source, retrieved on 2 October 2026.
  7. [7] Cbw Art. 58(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). No Cbw fine (Articles 80 and 87) if the AP has already imposed a GDPR fine for the same conduct for a data breach as referred to in Article 58, second paragraph. Original Dutch text:
    3. Indien de Autoriteit persoonsgegevens dan wel de bevoegde toezichthoudende autoriteiten, bedoeld in de artikelen 55 en 56 van de Algemene verordening gegevensbescherming een bestuurlijke boete opleggen op grond van artikel 58, tweede lid, onderdeel i, van de Algemene verordening gegevensbescherming, legt de bevoegde autoriteit geen bestuurlijke boete op op grond van de artikelen 80 en 87 voor een inbreuk als bedoeld in het tweede lid die voortvloeit uit dezelfde gedraging als die waarvoor de bestuurlijke boete op grond van artikel 58, tweede lid, onderdeel i, van de Algemene verordening gegevensbescherming is opgelegd.
    Source, retrieved on 6 November 2026.

Related questions

When and where do you report a significant incident under the Cbw?When is a cyber incident a significant incident?Must you inform your customers about a cyber incident?How do you set up incident handling under the Cbw (NIS2 21(2)(b))?

Next step

Register your organisation and your Cbw sector. Trusq sets up the duty of care, the reporting duty, the tasks of the management body and the registration as actions, each with the evidence that is expected and the article it rests on.

Set up the Cbw duties in Trusq

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.