Cybersecurity Policy Report, Organizations Should Have Plans for Ransomware Attacks, Dutch Agency Advises, (Aug 3, 2026)
By Tony Foley
In its 2025 ransomware report, the Dutch data protection authority, Autoriteit Persoonsgegevens (AP), said the report served both as an analysis of ransomware incidents over the last year and as a practical guide for organizations wishing to enhance their operational resilience.
In a July 28 press release, AP said the report summarized the agency’s analysis of the key lessons learned from real-world cases shared by a variety of organizations. The experiences shared by these organizations show that proper preparation, rapid decision-making, and clear communication can make a significant difference both for the organization and the individuals whose personal data has been affected by an incident.
According to the report, organizations that plan their incident response in advance can act more quickly and effectively when a ransomware incident occurs. Among the key lessons outlined in the report for organizations to consider are the following:
Ensure that suspicious activities are identified quickly;
Work with an up-to-date incident and crisis response plan;
Engage the right experts on time;
Know which personal data the organization processes and where they are located;
Inform data subjects in a clear and timely manner when their personal information is at risk; and
Continue investing in digital resilience and security.
The report indicates that organizations often underestimate the impact of ransomware attacks on individual victims, making it increasingly important that they quickly gain insight into the scale of an incident.
“Every ransomware attack is different, but the lessons are often the same,” said AP Deputy Chair Monique Verdier. “Organisations do not need to make every mistake themselves. By learning from one another, they can significantly limit the damage to people and to their own organisation.”
News: InternationalLegislation DataSecurity DataBreach