Supermarkets must report serious cyber incidents to NCSC, with NVWA checking compliance
The Cyberbeveiligingswet, in force since August, obliges supermarkets, banks, water firms and other key organisations to report major cyber incidents, and directors can be held personally liable.
The Cyberbeveiligingswet (cybersecurity law) took effect in August. It applies to government bodies and companies that are important to the Netherlands, including healthcare, drinking water, banks and the food sector, such as supermarkets.
Why it matters
- Covered organisations must report a cyber incident with major impact, or a suspicion of one, within 24 hours.
- They must give the NCSC an update after 72 hours.
- Directors can be held personally liable if a company's cybersecurity is not in order.
Reports go to the NCSC, the national cyber security centre, which passes them on to the supervisors that check compliance. For supermarkets, that supervisor is the Nederlandse Voedsel- en Warenautoriteit (NVWA), the food and consumer product safety authority.
The law requires organisations to take "appropriate" measures to prevent cyber incidents. A supervisor that suspects the protection was insufficient can impose penalties.
More on digital, tech and privacy · business and companies
Follow the story: NVWA
Cyberbeveiligingswet
The Dutch Cybersecurity Act, the Dutch law that implements the EU NIS2 directive on cyber security. It requires organisations that are important to society, such as healthcare providers, drinking water companies, banks and food businesses, to take security measures and to report serious cyber incidents. Under this law, such incidents must be reported within 24 hours.
NCSC (Nationaal Cyber Security Centrum)
The National Cyber Security Centre, the Dutch government's central body for cyber security. It monitors digital threats, warns organisations and the public, and helps respond to cyber incidents. Under the Cyberbeveiligingswet, it receives incident reports from organisations and passes them on to the relevant supervisory authorities.
NVWA (Nederlandse Voedsel- en Warenautoriteit)
The Netherlands Food and Consumer Product Safety Authority, the government inspectorate that supervises food safety and consumer products. It inspects food businesses and checks that products meet legal safety requirements. Under the Cyberbeveiligingswet, it is the supervisor for supermarkets and checks whether they have taken the required cyber security measures.