do we need to inform our customer if there has been a data breach

Usually yes, if the incident affects the service to that customer

In most cases you must report an incident to your customer, but not every incident and not to everyone. Article 21(2) of the NIS2 Directive names "incident handling" as one of the ten mandatory measures, and most customer questionnaires translate that to: do you have a process to report incidents, to whom, and within what timeframe. This is different from a legal reporting obligation to a supervisory authority — your customer's question concerns the contractual or operational arrangement between you and them, not the reporting obligation that the Cybersecurity Act will soon impose on certain entities.

A data breach that only affects your own internal systems and does not affect any data or service of that customer often falls outside the arrangement. Once the incident does affect data, systems or deliveries that are relevant to that customer, reporting is obvious — often within the timeframe set out in the contract or the data processing agreement, not within a timeframe we can state here. So first check what has been agreed in your own agreement with that customer, as that takes precedence over a general answer in a questionnaire.

What the evidence is and what you answer without procedure

The underlying evidence is the procedure for handling security incidents: it states who internally decides whether something must be reported, to whom, and within what timeframe. If you have not documented that procedure, then "no" is the factually correct answer — a yes without a document will not stand up to an audit. Customers who ask this question often also ask in the same questionnaire about policy for risk analysis and the security of information systems, because incident handling in Article 21(2) NIS2 and in Annex A of ISO/IEC 27001 is seen as a related part of the security policy, not as a separate process.