questionnaire asks how we would report a data breach to them

This question is about reporting procedures, not about reporting obligations to a supervisory authority

The customer is asking here how your incident process works, not whether you have already reported a data breach to the Authority for Personal Data. The answer being requested is a description of the process: how you identify a security incident, who is then notified internally, within what timeframe the customer themselves receives notification, and via which channel. That is precisely what should fall under the procedure for security incidents if you have already established a policy for it.

If you have such an established process, the answer is usually "yes": you have a procedure, a point of contact and an agreed reporting timeframe towards customers whose data or systems may have been affected. If this process is lacking, or exists only verbally, then "no" or "partly" is the factually correct answer — a commitment to do it "differently from now on" is not an answer for today. Also pay attention to the link with suppliers: if the incident originates with a third party working for you, that concerns the requirements you set for your own suppliers, and some questionnaires ask about this separately.

Why this falls under Article 21(2)

Incident reporting procedures are part of the ten measures of Article 21 paragraph 2 of the NIS2 Directive (Directive (EU) 2022/2555); part b mentions incident handling by name. In the Cyber Security Act, the Dutch transposition entering into force on 15 August 2026, the same obligation returns for entities falling under that act. ISO/IEC 27001 requests similar documentation in Annex A, under the control measures for incident management. Which of the three applies to you depends on whether your enterprise itself falls under one of those regulations — that is a different question than this one.