MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
Data breaches occur more frequently in the healthcare and welfare sector than in almost any other industry, and this entails concrete legal obligations. If you operate as a healthcare provider, practice, or healthcare-related company, you must assess every data breach, register it internally, and in many cases report it to the Dutch Data Protection Authority (AP) within 72 hours. Those who do not have this in order risk not only reputational damage but also an investigation and potential sanctions. On this page, we explain why the healthcare sector is so vulnerable, what exactly a data breach is, what your obligations are, and what steps you can take now.
Why the healthcare sector is the leader in data breaches
The Dutch Data Protection Authority publishes annual figures on reported data breaches. For years, the health and welfare sector has been the frontrunner: according to the AP, in 2024 several thousand reports came from this sector, more than from any other industry. The financial sector lags far behind.
There is a logical explanation for this. In healthcare, a great deal of work is done with special personal data: medical data, the citizen service number (BSN), name and address details, and treatment information. This data enjoys extra protection under the General Data Protection Regulation (GDPR), precisely because misuse can have major consequences for the data subject. Moreover, in healthcare, many people, systems, and paper files are mixed together, increasing the risk of errors.
What exactly is a data breach?
A data breach is a security breach that results in unintended access to, destruction, loss, alteration, or disclosure of personal data. It is therefore not just about hacks. These situations are also data breaches:
- A letter or email containing patient data that goes to the wrong recipient;
- A lost or stolen laptop, phone, or USB stick containing personal data;
- A lost paper file;
- A colleague who looks at a file without necessity;
- An infection with ransomware or malware in which data is encrypted or copied.
Figures from the AP show that the vast majority of data breaches are caused by human error, such as incorrectly sent mail or email. In addition, the number of data breaches caused by cyberattacks and data theft is increasing. A striking, more recent development is that personal data is leaking because employees enter data into AI chatbots, often due to time pressure or convenience.
GDPR and the data breach notification obligation: what do you need to do?
The obligation to notify data breaches has existed in the Netherlands since January 1, 2016, and was further tightened with the introduction of the GDPR on May 25, 2018. The core principle: if a laptop is accidentally leaked or an email containing patient data is sent to the wrong person, you must assess and document this.
The main rules at a glance:
- Register. You must document every data breach internally, even if you ultimately do not report it to the AP. The AP may request this register.
- Report to the AP. If the data breach poses a risk to the rights and freedoms of the data subjects, you must in principle report it to the Dutch Data Protection Authority within 72 hours of discovery.
- Inform those involved. If there is a high risk to those involved, you must also inform them yourself, for example patients or clients.
Whether a notification is required depends on the nature of the data and the risk. With medical data, that risk is easily present. If in doubt, it is advisable to have your assessment legally reviewed so that you can substantiate afterwards why you did or did not report.
What are the consequences of a data breach?
Reporting a data breach does not automatically lead to a sanction. The AP regularly issues a warning first or pushes for improvement. Nevertheless, a data breach is not a non-binding formality.
The main risks:
- Investigation by the AP. A report can be the starting point of a broader investigation, in which other shortcomings also come to light, such as a missing processing register or a processor agreement that is not in order.
- Fines and sanctions. The GDPR grants the DPA broad powers to take enforcement action, amounting to substantial fines. For instance, taxi service Uber was fined €600,000 in a previous case because a data breach was reported too late. The maximum GDPR fines are considerably higher.
- Damage to reputation and trust. Especially in healthcare, where trust is paramount, a data breach can severely damage the trust of patients and clients.
What can you do as a healthcare company to prevent data breaches?
As a healthcare provider, you bear a special responsibility to handle personal data with care. Prevention has two aspects in this regard: technical and legal.
Technical and organizational measures
- Encrypt data on laptops, phones, and USB sticks (encryption);
- Restrict access to files to those who really need them;
- Train employees in safely handling personal data, phishing, and AI tools;
- Keep software and security up to date against malware and ransomware;
- Make clear agreements regarding the practical use of AI chatbots.
An incident response plan
In addition, ensure you have an incident response plan: a playbook outlining the steps to follow in the event of a data breach and who takes which action. This allows you to act quickly, avoid missing the 72-hour notification period, and demonstrate to the Dutch Data Protection Authority (AP) later that you responded in a structured manner.
The legal basis in order
Many investigations by the AP cover not only the data breach itself, but also the underlying documentation. Therefore, ensure that the following documents are present and up-to-date:
- A processing register stating which personal data you process for which purpose;
- A data processing agreement with parties that process data on your behalf, such as a software supplier or administration office;
- A clear privacy statement in which you inform patients and clients about the processing of their data.
Frequently asked questions about data breaches in healthcare
Within what timeframe must I report a data breach?
If a data breach poses a risk to the data subjects, you must in principle report it to the Dutch Data Protection Authority within 72 hours of discovery. If you are unable to collect all information within that period, you may provide additional information later, but the initial notification must be made in a timely manner.
Do I have to report every data breach to the Dutch Data Protection Authority?
No. You only need to report if the data breach poses a risk to the rights and freedoms of the data subjects. However, you must register every data breach internally, including those you do not report. With medical data, the risk is often present, so have your assessment reviewed if in doubt.
Do I need to inform my patients or clients in the event of a data breach?
If the data breach is likely to pose a high risk to the individuals concerned, you must also inform them yourself. In healthcare, where sensitive medical data is often involved, this is frequently the case.
Can I get a fine for a data breach?
A data breach does not automatically lead to a fine. However, the Dutch Data Protection Authority (AP) can take action, especially if it turns out that your obligations were not in order or that you reported too late. Fines under the GDPR can be substantial.
What is the difference between registering and reporting a data breach?
Registering means that you internally record every data breach in an overview that the AP can request. Reporting means that you report the data breach to the AP, and this is only necessary if there is a risk to the data subjects. Therefore, you always register, but you do not report.
Need help with privacy and data breaches?
Do you want to be well prepared for data breaches, not only technically but also legally? We are happy to help. Whether you want to have your privacy and data protection reviewed, get your documentation in order, or have questions about a specific data breach: our legal experts will think along with you in plain language.
Are you facing an urgent problem or would you like tailored advice? Then view our legal assistance or schedule an intake directly. This ensures that your organization is well protected legally before things go wrong.
