Cyberattack response for companies in the Netherlands
Evidence, reports, counsel, insurance and public communications after a cyberattack in the Netherlands.
Текст статьи на этом языке недоступен; показывается английский.
Use this checklist when a company operating in the Netherlands suspects an attack. Choose the jurisdiction from the legal entity, affected information and operations; the reading language does not determine which law applies. Sources checked on 20 October 2026. This is a Mithril editorial workflow, not an official filing form. Confirm applicable duties with qualified counsel.
## 1. Establish the response team and preserve facts
Name an incident commander, technical lead, legal reviewer, communications owner and finance contact. Choose a trusted contact channel if the corporate account or email system may be compromised. Authorize the technical scope before collection or changes. Preserve supplied originals, acquisition times, time zones and hashes; keep summaries and translations as separate versions.
Prepare a minimum factual packet: discovery and awareness times, affected services, confirmed impact, suspected impact, evidence references, open questions and current owners. Unknown leakage or an uncertain person count stays unknown. Run technical response, counsel, reporting, communications and insurance in parallel; an unfinished investigation must not silently consume another task’s deadline.
## 2. Check local reporting routes and deadlines
For a reportable personal-data breach within the AP’s jurisdiction, assess the GDPR risk exception and notify within 72 hours of awareness where feasible. Record the risk decision and assess any separate obligation to inform affected people. [Autoriteit Persoonsgegevens — Zo meldt u een datalek](https://autoriteitpersoonsgegevens.nl/themas/beveiliging/datalekken/zo-meldt-u-een-datalek)
Use the NCSC’s current incident-reporting guidance to distinguish voluntary reporting from obligations applicable to covered organizations. NCSC incident reporting and AP privacy notification are separate. [NCSC — Cyberincidenten melden](https://www.ncsc.nl/cyberincidenten-melden-bij-het-ncsc)
Check the current Cyberbeveiligingswet/NIS2 and any product or sector rules for your organization. Do not apply a national cybersecurity deadline to every company or replace the GDPR clock with it. [NCSC — Incident melden](https://www.ncsc.nl/producten-en-diensten/incident-melden)
## 3. Brief counsel and review insurance early
Give counsel a restricted brief with the factual timeline, source inventory, known gaps and jurisdiction questions. Verify professional identity, conflicts, engagement scope and fees. Ask the policyholder’s insurer or broker about notice timing, panel providers and any preapproval before commissioning work. Separate notification from a later claim, coverage decision or payment. Record evidenced costs and uncertain losses without promising reimbursement.
## 4. Prepare public communications and direct notices
Prepare one approved factual version for each audience. A public statement should cover confirmed service impact, actions being taken, what remains under investigation, protective steps, a verified contact route and the next update. Do not invent attribution, promise a recovery date or describe unobserved exfiltration as “no data lost”. A press release does not automatically replace direct notices required by law or contract.
Draft structure: “We identified [confirmed event] on [time and zone]. [Confirmed impact]. We are taking [approved actions]. We are investigating [unknowns]. Affected people can [reviewed protective steps]. Contact [verified route]. The next update is planned for [approved time].” Replace every placeholder, review the exact version and record approval before publication.
## 5. Use the Agent preparation plan
The proposed Mithril Agent/Registry integration defines 12 preparation and tracking capabilities: evidence inventory, source-linked timeline, next actions, obligation review, recipient-specific drafts, counsel briefs, communications, loss schedules and receipt reconciliation. This enterprise workflow is planned. Publishing this guide does not make it an available executor or an official reporting connector. Authorized people submit and publish through the appropriate channels; any future delegated connector needs separate qualification.
## 6. Download the country process
The BPMN 2.0 file is an authored, non-executable reference with five concurrent workstreams, human decisions, review escalation and accepted handoffs. It includes this country’s source context, not an official authority process. The current Mithril execution subset does not implement every element in this model.
- [Download BPMN for the Netherlands (English)](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/nl/en.bpmn)
- [Read the planned capability contract](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/capabilities.json)
- [View artifact hashes and versions](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/manifest.json)
## 7. Keep an action and receipt ledger
For each action, record the recipient and purpose, accountable owner, source and trigger for a candidate deadline, confirmed review time, approved payload/version, dispatch record, official receipt and next step. Submission, receipt, acceptance, coverage and recovery are different outcomes. Reconcile an unknown result before retrying. Close operational response only after recovery approval and accepted ownership of continuing legal, regulatory and insurer work.
## Official sources for this country
- [Autoriteit Persoonsgegevens — Zo meldt u een datalek](https://autoriteitpersoonsgegevens.nl/themas/beveiliging/datalekken/zo-meldt-u-een-datalek)
- [NCSC — Cyberincidenten melden](https://www.ncsc.nl/cyberincidenten-melden-bij-het-ncsc)
- [NCSC — Incident melden](https://www.ncsc.nl/producten-en-diensten/incident-melden)
[Compare the other country guides](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en)