what people believe:
“we report it once we know what happened”
The clock runs from when you are aware, and a report can be incomplete. The Dutch authority fined the delay on its own.
The belief above is a common one, stated here in our words. It is not a quotation from the company.
what happened
Criminals phoned staff at 40 hotels in the United Arab Emirates and persuaded them to give up login details for a Booking.com system. According to the Dutch authority they reached the data of 4,109 people who had booked rooms there, and the credit card information of 283 people, with the security code in 97 cases.
22 days past the deadline
- 1December 2018: criminals phone staff at 40 hotels and get login details
- 213 January: Booking.com is informed
- 316 January: 72 hours are up
- 44 February: affected customers are told
- 57 February: the authority is told
basis GDPR Art. 33(1); Dutch Data Protection Authority, press release of 31 March 2021
basis GDPR Art. 33(1); Dutch Data Protection Authority, 31 March 2021
what the authority said
Its point was about timing and harm. A report lets the authority order a warning to the people affected, and the criminals used booking details to pose as hotel and Booking.com staff. Booking.com also took other steps to limit the damage, such as offering to cover losses, and that did not undo the delay. Booking.com did not lodge an objection to the decision.
basis Dutch Data Protection Authority, 31 March 2021
why it matters at your size
The scam needed no technical break-in, and the fine came from an ordinary failure: nobody got the decision to report made in time. You may send information in phases, so waiting for a full picture is not necessary. So decide now who can file a notification without approval.
basis GDPR Art. 33(4); EDPB Guidelines 9/2022
check it yourself
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Dutch Data Protection Authority: Booking.com fined for delay in reporting data breach
- EDPB Guidelines 9/2022 on personal data breach notification, version 2.0
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Write down who at your company can file a breach notification tonight, without waiting for approval.