# Do we have to tell our own customers about a NIS2 incident?

Sometimes. Under Article 23(1), where appropriate, entities in scope notify the recipients of their services without undue delay of significant incidents that are likely to adversely affect the provision of those services. Under Article 23(2), where applicable, entities also tell recipients potentially affected by a significant cyber threat what they can do in response, and, where appropriate, about the threat itself. Authorities can order such information too. National laws set the detail: in Germany, the BSI can order entities to inform recipients (section 35(1) BSIG), and entities in sectors such as finance, digital infrastructure and ICT service management must inform them about significant cyber threats (section 35(2)). Contracts and the GDPR may add their own duties. Prepare a customer message template as part of the incident plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/do-we-have-to-tell-customers-about-a-nis2-incident

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Do we have to report a ransomware attack under the GDPR?](https://netsenx.com/en/faq/do-we-have-to-report-ransomware-under-the-gdpr)
- [If the stolen data was encrypted, must we still notify?](https://netsenx.com/en/faq/if-stolen-data-was-encrypted-must-we-still-notify)
- [We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?](https://netsenx.com/en/faq/we-cannot-meet-72-hours-can-we-notify-in-phases)
- [When does the GDPR 72-hour notification clock start?](https://netsenx.com/en/faq/when-does-the-gdpr-72-hour-clock-start)
- [One incident, several reports: how do NIS2, the GDPR and DORA fit together?](https://netsenx.com/en/faq/one-incident-several-reports-nis2-gdpr-dora)