must I report a data breach to the customer whose data it concerns

Contractually usually yes, legally not automatically to the customer

Usually yes, but not because NIS2 prescribes it that way. Article 21(2) of the directive requires reporting a significant threat or incident to the national CSIRT or the competent authority — not directly to every customer. The obligation to report to the customer itself is usually set out in the contract or the data processing agreement, and this is often stricter and faster than what NIS2 requires. Those who only look at the directive and do not consult their own contracts will therefore miss the obligation that matters first in practice.

For the customer who raises the question in a questionnaire, it is usually not about the legal reporting obligation but about the process: do you have a fixed procedure to identify, assess and report an incident, and does it specify when a customer will be informed? That is precisely what the procedure for security incidents is about, and most questionnaires ask about the existence of that procedure, not about isolated cases. If the organisation does not have that procedure in writing, then "no" is the honest answer here — a promise that a customer will always be called cannot be filled in for you here.

What this is based on: Article 21(2) NIS2 and the organisation's own contract

Article 21(2) of Directive (EU) 2022/2555 lists the ten measures an entity must take, including under (i) an incident handling process; the obligation to report to an authority is set out in Article 23, not in paragraph (2) itself, and is directed to the CSIRT or the competent authority. Annex A of ISO/IEC 27001 contains a similar control measure for incident management, including communication to stakeholders, but there too the customer is not automatically the standard recipient — that is determined per organisation. The Cybersecurity Act, the Dutch transposition entering into force on 15 August 2026, follows the same structure. Those wishing to know whether their own organisation itself falls under these rules should check the question of whether the organisation is a NIS2 entity; reporting to the customer itself remains in all cases a matter of the applicable contract.