To get the best help for your situation, first answer the questions on the Preliminary questions page.
What should I do?
Data has been stolen or leaked from my organisation
Acute measures
Determine what has happened
Identify the data breach. Gather the persons in responsible positions together. Assess the risks. Decide what measures to take. Document the events.
Prevent further damage
Block the vulnerabilities and prevent misuses. Plan the communication about the incident. If necessary, adapt the operation of the organisation.
Notify the authorities
If necessary, notify the Data Protection Ombudsman and the National Cyber Security Centre. If you suspect an offence, report it to police.