customer asks how quickly we would notify them of a data breach

Three reporting moments within 72 hours, not one

The customer asks about a reporting deadline, but Article 21(2) of NIS2 does not provide a single deadline — it is a series of three moments. Within 24 hours of discovering a significant incident, an early warning is sent to the competent authority or the CSIRT. Within 72 hours, a more detailed report follows with an initial assessment of severity and impact. And within one month after resolution, a final report follows with the cause, measures taken and cross-border effects. If the questionnaire simply asks "within how many hours do you report a data breach", the answer is actually threefold, and you may fill it in that way: not a single figure, but the three steps with their own deadline.

Important detail: these deadlines apply to entities that themselves fall under the directive, and the reporting obligation is to their own supervisory authority — not automatically to the customer who sends the questionnaire. Whether the company itself is such a reporting entity depends on sector and size; this is described at is the enterprise covered by the NIS2 directive or its national implementation. What the customer usually wants to know is whether there is an internal procedure in place that meets such deadlines — this is a different matter from the legal reporting obligation to the government, and is dealt with separately at whether there is a procedure for handling security incidents.

Where that appears in the directive: Article 21(2), point b

The three reporting moments — 24 hours, 72 hours, one month — follow directly from Article 21(2)(b) of Directive (EU) 2022/2555. The Dutch Cybersecurity Act transposes this obligation into national law and comes into force on 15 August 2026; until that date the directive itself is the source, thereafter the text of the law as published on wetten.overheid.nl.