If necessary, the internal responsible is responsible for reporting the data breach to the Dutch Data Protection Authority.
Notification shall be made as quickly as possible and at the latest within 72 hours after discovery of the data breach.
Any employee other than the internal responsible is not permitted to report the (possible) data breach to the Dutch Data Protection Authority and/or people affected.
If an employee does not agree with the decision of the internal responsible regarding whether or not to report the Dutch Data Protection Authority and/or people affected, he/she can make his/her complaints known to the management.
If requested to do so, an employee will fully cooperate with the internal responsible in order to be able to inform the affected persons in accordance with Article 34 of the GDPR about the data breach.