This bill introduces a duty to notify the Dutch Data Protection Authority (College Bescherming Persoonsgegevens, the "CBP") and the relevant data subject(s) in the event of a breach of security measures for the protection of personal data. The duty will apply to businesses, governmental bodies and others, provided in all cases that they constitute a "data controller" within the meaning of the Personal Data Protection Act (Wet bescherming persoonsgegevens, the "PDPA"). The rule imposing the duty will be set out in a new provision of the PDPA (Article 34a).