{"id":582,"date":"2026-10-25T13:43:33","date_gmt":"2026-10-25T12:43:33","guid":{"rendered":"https:\/\/www.bureaubuitenland.be\/data-breach-protocol\/"},"modified":"2026-11-02T09:12:33","modified_gmt":"2026-11-02T08:12:33","slug":"data-breach-protocol","status":"publish","type":"page","link":"https:\/\/www.bureaubuitenland.be\/en\/data-breach-protocol\/","title":{"rendered":"Data breach protocol"},"content":{"rendered":"<p><section class=\"bb-sectie bb-artikelkop bb-artikelkop--beeld\" id=\"artikelkop\" data-bg=\"primary\" style=\"--bb-ak-img:url(https:\/\/www.bureaubuitenland.be\/wp-content\/uploads\/bb\/avg-datalek.webp)\"><div class=\"bb-container bb-artikelkop__inhoud\"><p class=\"bb-kicker\">GDPR<\/p><h1>Data breach protocol<\/h1><\/div><\/section><nav class=\"bb-breadcrumb\" aria-label=\"Breadcrumb\"><div class=\"bb-container\"><ol><li><a href=\"https:\/\/www.bureaubuitenland.be\/en\/\">Home<\/a><\/li><li><span aria-current=\"page\">Data breach protocol<\/span><\/li><\/ol><\/div><\/nav><section class=\"bb-sectie bb-kolommen\" id=\"inhoud\" data-bg=\"paper\"><div class=\"bb-container\"><div class=\"bb-kolommen__grid\"><div class=\"bb-kolom bb-kolom--hoofd\"><div class=\"bb-callout bb-callout--info\" id=\"vertaling\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">info<\/span><div><h3 class=\"bb-callout__kop\">Note<\/h3><div class=\"bb-callout__tekst\"><\/p>\n<p>This translation is provided for information. In case of discrepancy, the Dutch text prevails.<\/p>\n<p><\/div><\/div><\/div><section class=\"bb-sectie bb-sectie--tekst\" id=\"intro\" data-bg=\"paper\"><div class=\"bb-container\"><div class=\"bb-tekst\"><\/p>\n<p><strong>Protocol for the reporting and handling of a security incident or data breach<\/strong>, Bureaubuitenland Belgi\u00eb BV, version 2.0, October 2026. Replaces version 1.1 of 19 October 2018.<\/p>\n<h2>Purpose<\/h2>\n<p>The Algemene Verordening Gegevensbescherming (General Data Protection Regulation, GDPR) obliges organisations to report a data breach without undue delay, and where possible within 72 hours, to the supervisory authority and in certain cases also to the data subjects. This protocol describes how Bureaubuitenland Belgi\u00eb BV acts in the event of a (suspected) security incident or data breach, within its own organisation or at a party working for us.<\/p>\n<p>Because in investigations we act as processor on behalf of public centres for social welfare (OCMW), housing companies and other commissioning parties, we also always report a data breach affecting their data directly to the commissioning party concerned, as agreed in the data processing agreement.<\/p>\n<p>With this protocol we aim to be predictable for all stakeholders, to protect the interests of data subjects and commissioning parties, to analyse every incident carefully and to make structural improvements.<\/p>\n<p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"definitions\" data-bg=\"grijs\"><div class=\"bb-container\"><h2>Definitions<\/h2><div class=\"bb-tekst\"><\/p>\n<ul>\n<li><strong>Data subject<\/strong>: the person to whom personal data relate.<\/li>\n<li><strong>Security incident<\/strong>: a breach of security as a result of which personal data may have been exposed to loss or unlawful processing.<\/li>\n<li><strong>Data breach<\/strong>: a security incident in which personal data have actually been lost or unlawfully processed. Every data breach is a security incident; not every security incident is a data breach.<\/li>\n<li><strong>Controller<\/strong>: the party that determines the purpose and means of the processing. In investigations, this is the commissioning party.<\/li>\n<li><strong>Processor<\/strong>: the party that processes on behalf of the controller. In investigations, this is Bureaubuitenland Belgi\u00eb BV.<\/li>\n<li><strong>Response team<\/strong>: the management of Bureaubuitenland Belgi\u00eb BV, supplemented where necessary by the data protection officer and external experts.<\/li>\n<li><strong>Supervisory authority<\/strong>: the Belgian Data Protection Authority (GBA), Drukpersstraat 35, 1000 Brussel.<\/li>\n<\/ul>\n<p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-1-reporting\" data-bg=\"paper\"><div class=\"bb-container\"><h2>Step 1: reporting<\/h2><div class=\"bb-tekst\"><\/p>\n<p>Anyone who notices a (possible) security incident or data breach, internally or externally, reports it immediately to the management via <a href=\"mailto:info@bureaubuitenland.be\">info@bureaubuitenland.be<\/a> or by telephone on +31 (0)85 111 01 23. The report is not subject to any formal requirements: describe as fully as possible what happened, when, which data are concerned and who is involved. Where possible, attach evidence and indicate how urgent it is.<\/p>\n<p>The management takes up the report immediately, keeps a log of all events, decisions and times, and secures evidence.<\/p>\n<h2>Step 2: assessment<\/h2>\n<p>Within 24 hours of the report, the management assesses whether there is a security incident or a data breach. Factors taken into account include: whether personal data have been lost or unlawfully processed, whether sensitive data are involved, how many data subjects are affected, and what the possible consequences for them are.<\/p>\n<p>If there is only a security incident without loss or unlawful processing, the incident is registered and remedied, without notification to the supervisory authority. If there is (possibly) a data breach, the response team meets immediately.<\/p>\n<h2>Step 3: response team<\/h2>\n<p>The response team ensures and records: the immediate closing of the leak and limitation of its consequences, the decision whether and what to report to the supervisory authority, the notification to the commissioning party or parties concerned, the internal and external communication, whether a police report is necessary, and whether any damage is insured.<\/p>\n<p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-4-notification-to-the-commissioning-party\" data-bg=\"grijs\"><div class=\"bb-container\"><h2>Step 4: notification to the commissioning party<\/h2><div class=\"bb-tekst\"><\/p>\n<p>If the data breach affects data that we process as processor for a commissioning party, we inform that commissioning party without undue delay and at the latest within 24 hours of establishing the breach, with all the information the commissioning party needs for its own notification to the supervisory authority.<\/p>\n<h2>Step 5: notification to the Belgian Data Protection Authority<\/h2>\n<p>If Bureaubuitenland Belgi\u00eb BV is itself the controller, the management reports the data breach without undue delay and where possible within 72 hours of discovery to the Belgian Data Protection Authority (GBA) via the notification form on www.gegevensbeschermingsautoriteit.be. The acknowledgement of receipt and the completed form are kept in the log. The management is the point of contact for the supervisory authority.<\/p>\n<h2>Step 6: informing data subjects<\/h2>\n<p>If the data breach is likely to result in a high risk to the rights and freedoms of the data subjects, they are informed directly. The notification contains at least the nature of the breach, our contact details, the likely consequences and the measures we have taken and that the data subject can take themselves. In investigations, this is done in consultation with, and usually by, the commissioning party.<\/p>\n<p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-7-investigation-and-improvement\" data-bg=\"paper\"><div class=\"bb-container\"><h2>Step 7: investigation and improvement<\/h2><div class=\"bb-tekst\"><\/p>\n<p>The management investigates the actual course of events and how recurrence can be prevented. For this purpose it may speak with all parties involved, inspect all relevant documents and systems, call processors to account under the data processing agreement and engage external experts. Findings and improvement measures are recorded, implemented and evaluated for their effect.<\/p>\n<h2>Step 8: closure<\/h2>\n<p>Once the data breach has been definitively dealt with, the management informs the reporting person and those directly concerned. The incident, with all documents, is entered in the register of data breaches, which also contains the incidents that did not need to be reported.<\/p>\n<h2>Maintenance<\/h2>\n<p>This protocol is evaluated annually and after every incident by the management and adopted anew. Adopted by the management of Bureaubuitenland Belgi\u00eb BV in Antwerp, October 2026.<\/p>\n<p><\/div><\/div><\/section><\/div><div class=\"bb-kolom bb-kolom--zij\"><nav class=\"bb-toc\" aria-label=\"Table of contents\"><p class=\"bb-kicker\">Inhoud<\/p><\/nav><\/div><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--panel bb-bedrijf-sectie\" id=\"bedrijfskaart-sectie\" data-bg=\"panel\"><div class=\"bb-container\"><p class=\"bb-kicker\">CONTACT<\/p><h2>Company details<\/h2><div class=\"bb-kaart bb-bedrijfskaart bb-bedrijfskaart--breed\" id=\"bedrijfskaart\"><h3 class=\"bb-bedrijf__kop\">Bureaubuitenland Belgi\u00eb BV<\/h3><div class=\"bb-bedrijf__inhoud\"><div class=\"bb-bedrijf__contact\"><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">location_on<\/span><div><span class=\"bb-bedrijf__label\">Visiting address<\/span><span>Brusselstraat 51<br>2018 Antwerpen<br>Visits by appointment<\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">call<\/span><div><span class=\"bb-bedrijf__label\">Telephone<\/span><span><a href=\"tel:+31851110123\">+31 (0)85 111 01 23<\/a><\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">mail<\/span><div><span class=\"bb-bedrijf__label\">Email<\/span><span><a href=\"mailto:info@bureaubuitenland.be\">info@bureaubuitenland.be<\/a><\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">schedule<\/span><div><span class=\"bb-bedrijf__label\">Availability<\/span><span>Weekdays 9.00 to 17.00<\/span><\/div><\/div><\/div><dl class=\"bb-bedrijf__nummers\"><div><dt>Company number<\/dt><dd>0736.772.309<\/dd><\/div><div><dt>VAT<\/dt><dd>BE 0736.772.309<\/dd><\/div><div><dt>IBAN<\/dt><dd>BE20 0689 3580 0756<\/dd><\/div><\/dl><\/div><\/div><\/div><\/section><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":864,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-582","page","type-page","status-publish","has-post-thumbnail"],"bb_rendered":"<section class=\"bb-sectie bb-artikelkop bb-artikelkop--beeld\" id=\"artikelkop\" data-bg=\"primary\" style=\"--bb-ak-img:url(https:\/\/www.bureaubuitenland.be\/wp-content\/uploads\/bb\/avg-datalek.webp)\"><div class=\"bb-container bb-artikelkop__inhoud\"><p class=\"bb-kicker\">GDPR<\/p><h1>Data breach protocol<\/h1><\/div><\/section><nav class=\"bb-breadcrumb\" aria-label=\"Breadcrumb\"><div class=\"bb-container\"><ol><li><a href=\"https:\/\/www.bureaubuitenland.be\/en\/\">Home<\/a><\/li><li><span aria-current=\"page\">Data breach protocol<\/span><\/li><\/ol><\/div><\/nav><section class=\"bb-sectie bb-kolommen\" id=\"inhoud\" data-bg=\"paper\"><div class=\"bb-container\"><div class=\"bb-kolommen__grid\"><div class=\"bb-kolom bb-kolom--hoofd\"><div class=\"bb-callout bb-callout--info\" id=\"vertaling\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">info<\/span><div><h3 class=\"bb-callout__kop\">Note<\/h3><div class=\"bb-callout__tekst\"><p>This translation is provided for information. In case of discrepancy, the Dutch text prevails.<\/p><\/div><\/div><\/div><section class=\"bb-sectie bb-sectie--tekst\" id=\"intro\" data-bg=\"paper\"><div class=\"bb-container\"><div class=\"bb-tekst\"><p><strong>Protocol for the reporting and handling of a security incident or data breach<\/strong>, Bureaubuitenland Belgi\u00eb BV, version 2.0, October 2026. Replaces version 1.1 of 19 October 2018.<\/p>\n<h2>Purpose<\/h2>\n<p>The Algemene Verordening Gegevensbescherming (General Data Protection Regulation, GDPR) obliges organisations to report a data breach without undue delay, and where possible within 72 hours, to the supervisory authority and in certain cases also to the data subjects. This protocol describes how Bureaubuitenland Belgi\u00eb BV acts in the event of a (suspected) security incident or data breach, within its own organisation or at a party working for us.<\/p>\n<p>Because in investigations we act as processor on behalf of public centres for social welfare (OCMW), housing companies and other commissioning parties, we also always report a data breach affecting their data directly to the commissioning party concerned, as agreed in the data processing agreement.<\/p>\n<p>With this protocol we aim to be predictable for all stakeholders, to protect the interests of data subjects and commissioning parties, to analyse every incident carefully and to make structural improvements.<\/p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"definitions\" data-bg=\"grijs\"><div class=\"bb-container\"><h2>Definitions<\/h2><div class=\"bb-tekst\"><ul>\n<li><strong>Data subject<\/strong>: the person to whom personal data relate.<\/li>\n<li><strong>Security incident<\/strong>: a breach of security as a result of which personal data may have been exposed to loss or unlawful processing.<\/li>\n<li><strong>Data breach<\/strong>: a security incident in which personal data have actually been lost or unlawfully processed. Every data breach is a security incident; not every security incident is a data breach.<\/li>\n<li><strong>Controller<\/strong>: the party that determines the purpose and means of the processing. In investigations, this is the commissioning party.<\/li>\n<li><strong>Processor<\/strong>: the party that processes on behalf of the controller. In investigations, this is Bureaubuitenland Belgi\u00eb BV.<\/li>\n<li><strong>Response team<\/strong>: the management of Bureaubuitenland Belgi\u00eb BV, supplemented where necessary by the data protection officer and external experts.<\/li>\n<li><strong>Supervisory authority<\/strong>: the Belgian Data Protection Authority (GBA), Drukpersstraat 35, 1000 Brussel.<\/li>\n<\/ul><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-1-reporting\" data-bg=\"paper\"><div class=\"bb-container\"><h2>Step 1: reporting<\/h2><div class=\"bb-tekst\"><p>Anyone who notices a (possible) security incident or data breach, internally or externally, reports it immediately to the management via <a href=\"mailto:info@bureaubuitenland.be\">info@bureaubuitenland.be<\/a> or by telephone on +31 (0)85 111 01 23. The report is not subject to any formal requirements: describe as fully as possible what happened, when, which data are concerned and who is involved. Where possible, attach evidence and indicate how urgent it is.<\/p>\n<p>The management takes up the report immediately, keeps a log of all events, decisions and times, and secures evidence.<\/p>\n<h2>Step 2: assessment<\/h2>\n<p>Within 24 hours of the report, the management assesses whether there is a security incident or a data breach. Factors taken into account include: whether personal data have been lost or unlawfully processed, whether sensitive data are involved, how many data subjects are affected, and what the possible consequences for them are.<\/p>\n<p>If there is only a security incident without loss or unlawful processing, the incident is registered and remedied, without notification to the supervisory authority. If there is (possibly) a data breach, the response team meets immediately.<\/p>\n<h2>Step 3: response team<\/h2>\n<p>The response team ensures and records: the immediate closing of the leak and limitation of its consequences, the decision whether and what to report to the supervisory authority, the notification to the commissioning party or parties concerned, the internal and external communication, whether a police report is necessary, and whether any damage is insured.<\/p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-4-notification-to-the-commissioning-party\" data-bg=\"grijs\"><div class=\"bb-container\"><h2>Step 4: notification to the commissioning party<\/h2><div class=\"bb-tekst\"><p>If the data breach affects data that we process as processor for a commissioning party, we inform that commissioning party without undue delay and at the latest within 24 hours of establishing the breach, with all the information the commissioning party needs for its own notification to the supervisory authority.<\/p>\n<h2>Step 5: notification to the Belgian Data Protection Authority<\/h2>\n<p>If Bureaubuitenland Belgi\u00eb BV is itself the controller, the management reports the data breach without undue delay and where possible within 72 hours of discovery to the Belgian Data Protection Authority (GBA) via the notification form on www.gegevensbeschermingsautoriteit.be. The acknowledgement of receipt and the completed form are kept in the log. The management is the point of contact for the supervisory authority.<\/p>\n<h2>Step 6: informing data subjects<\/h2>\n<p>If the data breach is likely to result in a high risk to the rights and freedoms of the data subjects, they are informed directly. The notification contains at least the nature of the breach, our contact details, the likely consequences and the measures we have taken and that the data subject can take themselves. In investigations, this is done in consultation with, and usually by, the commissioning party.<\/p><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--tekst\" id=\"step-7-investigation-and-improvement\" data-bg=\"paper\"><div class=\"bb-container\"><h2>Step 7: investigation and improvement<\/h2><div class=\"bb-tekst\"><p>The management investigates the actual course of events and how recurrence can be prevented. For this purpose it may speak with all parties involved, inspect all relevant documents and systems, call processors to account under the data processing agreement and engage external experts. Findings and improvement measures are recorded, implemented and evaluated for their effect.<\/p>\n<h2>Step 8: closure<\/h2>\n<p>Once the data breach has been definitively dealt with, the management informs the reporting person and those directly concerned. The incident, with all documents, is entered in the register of data breaches, which also contains the incidents that did not need to be reported.<\/p>\n<h2>Maintenance<\/h2>\n<p>This protocol is evaluated annually and after every incident by the management and adopted anew. Adopted by the management of Bureaubuitenland Belgi\u00eb BV in Antwerp, October 2026.<\/p><\/div><\/div><\/section><\/div><div class=\"bb-kolom bb-kolom--zij\"><nav class=\"bb-toc\" aria-label=\"Table of contents\"><p class=\"bb-kicker\">Inhoud<\/p><\/nav><\/div><\/div><\/div><\/section><section class=\"bb-sectie bb-sectie--panel bb-bedrijf-sectie\" id=\"bedrijfskaart-sectie\" data-bg=\"panel\"><div class=\"bb-container\"><p class=\"bb-kicker\">CONTACT<\/p><h2>Company details<\/h2><div class=\"bb-kaart bb-bedrijfskaart bb-bedrijfskaart--breed\" id=\"bedrijfskaart\"><h3 class=\"bb-bedrijf__kop\">Bureaubuitenland Belgi\u00eb BV<\/h3><div class=\"bb-bedrijf__inhoud\"><div class=\"bb-bedrijf__contact\"><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">location_on<\/span><div><span class=\"bb-bedrijf__label\">Visiting address<\/span><span>Brusselstraat 51<br>2018 Antwerpen<br>Visits by appointment<\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">call<\/span><div><span class=\"bb-bedrijf__label\">Telephone<\/span><span><a href=\"tel:+31851110123\">+31 (0)85 111 01 23<\/a><\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">mail<\/span><div><span class=\"bb-bedrijf__label\">Email<\/span><span><a href=\"mailto:info@bureaubuitenland.be\">info@bureaubuitenland.be<\/a><\/span><\/div><\/div><div class=\"bb-bedrijf__rij\"><span class=\"bb-icoon material-symbols-outlined\" aria-hidden=\"true\">schedule<\/span><div><span class=\"bb-bedrijf__label\">Availability<\/span><span>Weekdays 9.00 to 17.00<\/span><\/div><\/div><\/div><dl class=\"bb-bedrijf__nummers\"><div><dt>Company number<\/dt><dd>0736.772.309<\/dd><\/div><div><dt>VAT<\/dt><dd>BE 0736.772.309<\/dd><\/div><div><dt>IBAN<\/dt><dd>BE20 0689 3580 0756<\/dd><\/div><\/dl><\/div><\/div><\/div><\/section>","_links":{"self":[{"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/pages\/582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/comments?post=582"}],"version-history":[{"count":1,"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/pages\/582\/revisions"}],"predecessor-version":[{"id":865,"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/pages\/582\/revisions\/865"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/media\/864"}],"wp:attachment":[{"href":"https:\/\/www.bureaubuitenland.be\/en\/wp-json\/wp\/v2\/media?parent=582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}