Cyber Incidents

Cyber Incidents: When must your company report, to whom and by what deadline?

The first hours following a cyber incident are rarely straightforward. Nevertheless, legal reporting periods may begin before the technical cause and full impact of the incident are known to you.

Companies should therefore not wait for complete certainty. They should determine in advance (though an incident-response plan) who assesses an incident, who decides whether a notification is required and what information must immediately be collected.

Depending on your company’s sector, the data affected and the impact on its services, a single incident may activate several notification regimes.

1. NIS2: reporting significant incidents

Belgian “essential and important entities” falling within the scope of the NIS2 legislation must report significant incidents to the Centre for Cybersecurity Belgium. The reporting process generally involves: an early warning within 24 hours; a more detailed incident notification within 72 hours;
an intermediate report if requested; and a final report within one month of the incident notification, or a progress report if the incident is still ongoing. The company must first assess whether the incident satisfies the applicable significance threshold. This may be the case where it causes, or is capable of causing, severe operational disruption or financial loss, or considerable damage to other persons.

2. GDPR: does the incident also involve personal data?

Not every cyber incident constitutes a personal-data breach, and not every personal-data breach results from a cyberattack. However, a ransomware attack in which personal data is accessed, extracted, altered or made unavailable may constitute both. Where a personal-data breach is likely to result in a risk to individuals’ rights and freedoms, the controller must notify the (Belgian) Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk, the affected individuals may also need to be informed. Even if no notification is required, the company should document the incident, its risk assessment and the reasons for its decision.

3. DORA: additional requirements for the financial sector

Financial entities may face a separate reporting regime under the Digital Operational Resilience Act, or DORA, for major ICT-related incidents. The initial notification must generally be submitted as early as possible and no later than: four hours after the incident has been classified as major; and 24 hours after the financial entity became aware of the incident.

4. Other possible reporting obligation grounds

A cyber incident can also trigger contractual, insurance-related, sector-specific and internal notification obligations.

Commercial agreements increasingly contain cybersecurity and incident-notification clauses. These may require a company to notify customers or other contractual counterparties within a specified periods, even if the incident does not meet the statutory reporting thresholds.

In addition, a cyber-insurance policy may require the insured company to notify the insurer or an appointed incident-response provider immediately after discovering a potential incident. The policy may also require prior approval before the company appoints external experts, or ransomware negotiators. Failure to follow the notification and cooperation requirements could affect the availability of insurance coverage.

to customers, employees, suppliers, the board, law-enforcement authorities and other stakeholders.

5. Visual overview