Data breach protocol

Protocol for the reporting and handling of a security incident or data breach, Bureaubuitenland België BV, version 2.0, October 2026. Replaces version 1.1 of 19 October 2018.

Purpose

The Algemene Verordening Gegevensbescherming (General Data Protection Regulation, GDPR) obliges organisations to report a data breach without undue delay, and where possible within 72 hours, to the supervisory authority and in certain cases also to the data subjects. This protocol describes how Bureaubuitenland België BV acts in the event of a (suspected) security incident or data breach, within its own organisation or at a party working for us.

Because in investigations we act as processor on behalf of public centres for social welfare (OCMW), housing companies and other commissioning parties, we also always report a data breach affecting their data directly to the commissioning party concerned, as agreed in the data processing agreement.

With this protocol we aim to be predictable for all stakeholders, to protect the interests of data subjects and commissioning parties, to analyse every incident carefully and to make structural improvements.

• Data subject: the person to whom personal data relate.
• Security incident: a breach of security as a result of which personal data may have been exposed to loss or unlawful processing.
• Data breach: a security incident in which personal data have actually been lost or unlawfully processed. Every data breach is a security incident; not every security incident is a data breach.
• Controller: the party that determines the purpose and means of the processing. In investigations, this is the commissioning party.
• Processor: the party that processes on behalf of the controller. In investigations, this is Bureaubuitenland België BV.
• Response team: the management of Bureaubuitenland België BV, supplemented where necessary by the data protection officer and external experts.
• Supervisory authority: the Belgian Data Protection Authority (GBA), Drukpersstraat 35, 1000 Brussel.

Anyone who notices a (possible) security incident or data breach, internally or externally, reports it immediately to the management via info@bureaubuitenland.be or by telephone on +31 (0)85 111 01 23. The report is not subject to any formal requirements: describe as fully as possible what happened, when, which data are concerned and who is involved. Where possible, attach evidence and indicate how urgent it is.

The management takes up the report immediately, keeps a log of all events, decisions and times, and secures evidence.

Step 2: assessment

Within 24 hours of the report, the management assesses whether there is a security incident or a data breach. Factors taken into account include: whether personal data have been lost or unlawfully processed, whether sensitive data are involved, how many data subjects are affected, and what the possible consequences for them are.

If there is only a security incident without loss or unlawful processing, the incident is registered and remedied, without notification to the supervisory authority. If there is (possibly) a data breach, the response team meets immediately.

Step 3: response team

The response team ensures and records: the immediate closing of the leak and limitation of its consequences, the decision whether and what to report to the supervisory authority, the notification to the commissioning party or parties concerned, the internal and external communication, whether a police report is necessary, and whether any damage is insured.

If the data breach affects data that we process as processor for a commissioning party, we inform that commissioning party without undue delay and at the latest within 24 hours of establishing the breach, with all the information the commissioning party needs for its own notification to the supervisory authority.

Step 5: notification to the Belgian Data Protection Authority

If Bureaubuitenland België BV is itself the controller, the management reports the data breach without undue delay and where possible within 72 hours of discovery to the Belgian Data Protection Authority (GBA) via the notification form on www.gegevensbeschermingsautoriteit.be. The acknowledgement of receipt and the completed form are kept in the log. The management is the point of contact for the supervisory authority.

Step 6: informing data subjects

If the data breach is likely to result in a high risk to the rights and freedoms of the data subjects, they are informed directly. The notification contains at least the nature of the breach, our contact details, the likely consequences and the measures we have taken and that the data subject can take themselves. In investigations, this is done in consultation with, and usually by, the commissioning party.

The management investigates the actual course of events and how recurrence can be prevented. For this purpose it may speak with all parties involved, inspect all relevant documents and systems, call processors to account under the data processing agreement and engage external experts. Findings and improvement measures are recorded, implemented and evaluated for their effect.

Step 8: closure

Once the data breach has been definitively dealt with, the management informs the reporting person and those directly concerned. The incident, with all documents, is entered in the register of data breaches, which also contains the incidents that did not need to be reported.

Maintenance

This protocol is evaluated annually and after every incident by the management and adopted anew. Adopted by the management of Bureaubuitenland België BV in Antwerp, October 2026.