Have a data breach protocol drawn up: costs and process

Having a data breach protocol drawn up by a specialized SME lawyer typically costs between €400 and €1,200, depending on the size of your organization and the sensitivity of the data you process. You are paying for a playbook that works under time pressure: a proper notification chain, a usable risk assessment, and the assurance that you will not miss the 72-hour notification period (Art. 33 GDPR) and the registration requirement (Art. 33, paragraph 5 GDPR). For a small business with little sensitive data, a good template often suffices, but for special categories of data, outsourcing pays off.

The short answer

• Having it drawn up usually costs between 400 and 1,200 euros, depending on size and sensitivity.
• You pay for a workable contingency plan with a correct reporting chain and risk assessment.
• For a small business with little sensitive data, a good model is often sufficient.
• For special personal data, multiple processors, or large data flows, drafting a professional document pays off.
• An error in the assessment or the notification period can lead to a fine from the Dutch Data Protection Authority.

Have a data breach protocol drawn up: what do you get?

Anyone who has the protocol drawn up receives a roadmap tailored to their own organization. A standard text from the internet rarely covers your actual situation: which data you process, which processors you work with, and who is available on a Saturday evening. The legal expert translates the requirements of the GDPR into concrete steps, roles, and decision points that fit how your company operates.

The delivered protocol typically contains a clear definition, a reporting point, assessment criteria, a decision tree for notifications to the Dutch Data Protection Authority and to data subjects, a register format, and a prepared communication text. This allows you to act immediately in the event of an incident, rather than having to figure out the procedure from scratch.

The costs in focus

The price depends on the complexity:

• Ready-made model: the cheapest, suitable for a small company with limited data.
• Tailor-made, small organization: typically 400 to 700 euros for a tailored basic protocol.
• Larger or sensitive processing: 700 to 1,200 euros or more for special data, multiple processors, or complex systems.
• Additional training: hourly rate for onboarding employees, so that the protocol is actually followed.

Weigh those costs against the risk. The Dutch Data Protection Authority can impose fines if you fail to report a mandatory data breach, report it too late, or if your documentation is not in order. In the event of a serious incident, the consequences of acting too late far outweigh the price of a good protocol.

When outsourcing pays off

Outsourcing is particularly sensible when processing special personal data, such as health or financial data, as the likelihood of a high risk and a reporting obligation is greater in such cases. With multiple processors or complex systems, you also want assurance that the reporting chain is complete. And if you work in a sector with stricter supervision, a professional protocol helps to demonstrate that you are diligent.

A practical example: a physiotherapy practice processes patients' health data and works with an external software platform. Due to the sensitivity of the matter, the practice had a protocol drawn up. The legal expert established the reporting chain with the software supplier and developed the risk assessment for health data. In the event of a subsequent incident, the practice knew immediately that and how to report.

The process step by step

1. Intake: you describe which data you process, with which systems and processors, and who is available.
2. Analysis: the legal expert determines the risks and the reporting chain that suit your organization.
3. Drafting: the script is built with roles, a decision tree, an index, and communication texts.
4. Alignment: you test whether the steps are workable in practice and the protocol is refined.
5. Implementation: optionally a brief instruction for employees so that the protocol is followed.

The turnaround time is often between a few days and two weeks. A basic protocol for a small organization is ready quickly; a protocol involving multiple processors and sensitive data requires more coordination.

Do it yourself or have it done?

The assessment is realistic. Doing it yourself is feasible for a small company with limited, low-sensitive data and a good model. Outsourcing pays off as soon as you work with sensitive data, multiple processors, or larger data flows, or when you need to demonstrate due diligence towards a regulator. An intermediate form is a custom-designed protocol that you then keep up-to-date yourself in the event of changes to your systems.

Honest recommendation

If you process little and minimally sensitive personal data, you do not need to have anything drawn up. A good model in which the 72-hour clock, the notification threshold, and the registration obligation are correctly incorporated will suffice for you. Outsourcing is unnecessary in that case.

Do have the protocol drawn up when you process special categories of personal data, work with multiple processors, or manage larger data flows. In such cases, risk assessment and the reporting chain require closer attention, and you want to be certain that you act promptly and correctly in the event of an incident. Against the backdrop of potential fines and reputational damage, that investment is small.

You can find more background information at what is a data breach protocol and at drafting a data breach protocol. You can have a document created via the data breach protocolpage.

Frequently Asked Questions