Duty of Aftercare in Data Breaches

In brief

The consequences of a data breach do not end when systems have been restored. Stolen personal data may continue to be used for identity fraud, phishing and other forms of misuse. In this position paper, Cyberveilig Nederland calls on legislators, policymakers and regulators to strengthen aftercare for primary and secondary victims structurally.

Five recommendations

• Strengthen existing oversight and invest in risk-based enforcement.
• Protect the information position of primary and secondary victims through concrete, comprehensible and risk-based communication.
• Establish a recognisable safety net where victims can obtain support and file a police report with a low threshold.
• Do not pay ransom unless exceptional circumstances make this necessary, and always act transparently towards the regulator.
• Make the system capable of learning through information exchange between regulators, the NCSC, researchers and other relevant organisations.

Why this matters

For victims, the harm often begins only after a data breach has been reported. Names and addresses, identity documents, health data and financial information can give criminals new opportunities for fraud and deception. At the same time, Cyberveilig Nederland stresses that the affected organisation is generally a victim as well. Obligations should therefore remain proportionate, workable and scalable.

About the document

This four-page position paper was published by Cyberveilig Nederland. Use the button below the page content to view or download the complete English PDF.