do I need to report a hack or data breach to my client

Reporting to the client is usually contractual, not legal

The obligation to report a cyber incident is in most cases laid down in the contract with your client, not directly in the law. Article 21(2) of the NIS2 Directive requires organisations that fall under the directive themselves to implement incident response and to report to their own competent authority — this is the list of ten measures you see in virtually every questionnaire. This obligation to report to a competent authority is different from an obligation to report to a client. Whether you must report an incident to your principal therefore depends on what is stipulated in the processor agreement or service agreement, and on whether your client falls under the NIS2 Directive themselves and is therefore dependent on your report to keep their own supply chain in order.

In practice, the questionnaire does not ask "have you had an incident", but whether there is a procedure in place to detect, assess and report incidents — that is exactly what the question about a procedure for security incidents is aiming for. If you have that procedure, you can answer that question with yes without ever having to say whether and when you experienced a concrete incident. The latter remains a separate, contractual question that can differ per client.

What this is based on: Cybersecurity Act and Annex A

The Cybersecurity Act, the Dutch implementation of NIS2 which enters into force on 15 August 2026, sets out the obligation to report to the competent authority for entities that fall under the Act — whether this applies to your enterprise is the question that also comes back at whether the organisation itself falls under the NIS2 directive. ISO/IEC 27001 Annex A elaborates on this internally as a control measure for incident management, separate from any obligation to report to an external party. A contractual obligation to report to a client thus sits alongside, not in place of, this legal and normative framework.