how do I answer the question about our notification procedure in case of a data breach

The reporting procedure itself, not the data breach

The question is about your internal process, not whether there has ever been a leak before. The customer wants to know whether there is a documented procedure in place for handling security incidents: who reports a suspicion, to whom, within what timeframe escalation occurs, and who decides whether to inform a supervisory authority or the individuals affected. This is the same procedure as is asked about in the procedure for security incidents — a data breach is in practice a specific type of incident within that process, not a separate document.

If you have that procedure, a "yes" can be substantiated with the document itself: a step-by-step plan, a responsible function (often a security officer or DPO), and a record of previous reports as evidence that the process is also working. If a documented procedure is missing, but an informal line does exist ("call the owner"), then that is usually not enough for a "yes" — the file has no source to rely on, and in that case the system does not suggest an answer. Some customers also ask in the same list whether you yourselves are subject to a reporting obligation; this is a different question from the procedure itself, and can be traced via the status as a NIS2 entity.

Why this falls under Article 21(2)

Article 21(2) of the NIS2 Directive lists "incident handling" as one of the ten mandatory measures, and a data breach reporting procedure is its implementation towards personal data. ISO/IEC 27001 Annex A elaborates on this further in the control measures around incident management, which explains why customers with an ISO question often accept the same procedure as evidence. The Cybersecurity Act, the Dutch transposition, enters into force on 15 August 2026 and will also establish this obligation nationally for the entities that fall under it.