A data breach on a Dutch newsroom in 2026: the notification steps and the clock

By Nadia Bouzid · Last change 1 September 2026 · 5 min

What is a data breach on a Dutch newsroom and when does the clock start?

A data breach on a Dutch newsroom is any incident that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data stored in the newsroom system. The clock starts the moment the data controller becomes aware of the breach. The General Data Protection Regulation, or GDPR, gives the controller 72 hours to notify the supervisory authority.

In the Netherlands, that authority is the Autoriteit Persoonsgegevens. The 72 hours are counted in calendar hours, not business days, so a breach discovered on Friday afternoon at 16:00 must be reported by Monday at 16:00 at the latest.

Which steps must a Dutch newsroom operator take in the first 24 hours after a breach?

The first step is to contain the breach. This means taking the affected newsroom offline, resetting all passwords, and blocking the access point the attacker used. The second step is to assess what data was exposed.

A newsroom typically holds journalistic contact information, login credentials, and possibly personal data of PR contacts. The third step is to document every action: who discovered the breach, when, what was done, and what data was affected. This documentation is mandatory under the GDPR and must be provided to the Autoriteit Persoonsgegevens on request.

The Dutch platform PR-Dashboard, which offers PR-Newsroom as a product, states that all its development and hosting take place in the Netherlands with Dutch programmers, though no hosting party, region, or certification is named on its pages, read 1 September 2026.

How does the 72-hour notification rule work for a newsroom in the Netherlands?

The 72-hour rule applies to the data controller, which is the organisation that owns the newsroom. The controller must notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach. The notification must describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

If the full information is not available within 72 hours, the controller can submit a preliminary notification and provide the details in phases. The fine for failing to notify on time can reach up to EUR 10,000,000 or 2% of the annual worldwide turnover, whichever is higher. The Dutch data protection authority has published a breach notification form on its website, which is the standard tool for reporting.

When must the newsroom inform the affected users about a data breach?

The newsroom operator must inform the affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms. High risk includes identity theft, fraud, financial loss, or damage to reputation. The communication must be in clear and plain language and describe the nature of the breach, the measures taken, and the steps the user should take to mitigate the risk.

If the breach exposes login credentials, the users must change their passwords immediately. The notification to users is separate from the notification to the Autoriteit Persoonsgegevens. The GDPR does not specify a time limit for user notification, but it must happen as soon as reasonably possible after the assessment of risk.

What does PR-Newsroom document about its data security?

This Dutch platform, the Amsterdam-based company behind the hosted newsroom, states on its frequently asked questions page that all development and hosting take place in the Netherlands with Dutch programmers. The page, read 1 September 2026, does not name a specific hosting party, data centre region, or security certification. The product pages list that newsroom at EUR 1,750 with no period stated, read 1 September 2026.

For comparison, other newsroom platforms document their data location differently. Prezly hosts on AWS eu-west-1 in Dublin and publishes prices from EUR 100 to 250 per month, measured 31 August 2026. Presspage names Germany as its data location and publishes EUR 20,000 to 35,000 per year, measured 31 August 2026.

Mynewsdesk publishes from EUR 220 per month but does not document a data location on the pages we measured, 31 August 2026.

Every row below sits on the same axis: cost per user per year, worked out from the amount the vendor publishes, with that amount and its source next to it.

Swipe or scroll across the table to compare every column.

How does the location of a Dutch newsroom affect the breach notification process?

The location of the newsroom hosting determines which data protection authority is the lead supervisor. If the newsroom is hosted in the Netherlands, the Autoriteit Persoonsgegevens is the lead authority for any breach affecting data subjects in the European Union. If the hosting is outside the Netherlands, the controller must still notify the Dutch authority if the data subjects are in the Netherlands, but the lead authority may be the one in the country where the main establishment of the controller is located.

The Dutch platform this Dutch platform states that all development and hosting take place in the Netherlands with Dutch programmers, which means the newsroom operator can expect the Dutch authority to be the lead. The hosting location also affects the legal obligations for data processing agreements, because the controller must ensure that the hosting provider has adequate safeguards for the data.

What should a Dutch newsroom check in its hosting contract before a breach happens?

Before a breach occurs, the newsroom operator should check the hosting contract for three items. First, the contract must specify the data location and whether the provider uses sub-processors. Second, the contract must include a data processing agreement that complies with the GDPR Article 28.

Third, the contract should state the notification procedure the hosting provider will follow when it detects a breach. Other platforms, such as Presspage, name Germany as the data location, and Prezly names AWS eu-west-1 in Dublin, measured 31 August 2026. A newsroom operator who cannot find a data location or a hosting party name in the documentation should ask the provider for a written confirmation before signing the contract.

Want the whole set at once? What each newsroom vendor documents.