# Is it better to disclose past security incidents to customers?

Often yes, and sometimes you must. Under the GDPR, people must be told about a personal data breach that is likely to result in a high risk to them, NIS2 can require you to inform the recipients of your services about significant incidents, and contracts often add notification duties of their own. Beyond what is required, disclosure is a business decision: customers who learn of an incident from a journalist or a leak site rarely forgive the silence, while a clear account of what happened and what you changed can strengthen trust. Agree a disclosure line with management, legal advice and your insurer before an incident, not during one. Keep the facts ready: when it started, what was affected and what was done.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/is-it-better-to-disclose-past-incidents-to-customers

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [What records do we need to answer questions about past incidents?](https://netsenx.com/en/faq/what-records-do-we-need-to-answer-questions-about-past-incidents)
- [What should the board know about the cost of IT downtime?](https://netsenx.com/en/faq/what-should-the-board-know-about-the-cost-of-downtime)
- [What questions should the board ask the IT manager about security?](https://netsenx.com/en/faq/what-questions-should-the-board-ask-the-it-manager)
- [What should cyber security training for the board cover?](https://netsenx.com/en/faq/what-should-cyber-security-training-for-the-board-cover)
- [Who should own cyber security in a small company?](https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company)