When does the 24-hour clock start?

When you become aware of the significant incident, not when the attack began. An attacker may have been inside for weeks; the 24 hours start the moment you find out.

Does the one month count from the incident?

No. The final report is due at the latest one month after you sent the 72-hour incident notification. If the incident is still going on by then, you send a progress report, and the final report within one month after you have dealt with it.

Where do I report a NIS2 incident in Belgium?

On the CCB notification platform, notif.safeonweb.be. NIS2 entities can also call the CCB emergency line on +32 (0)2 501 05 60. A personal data breach goes separately to the Data Protection Authority (GBA/APD).

Does this apply to my company?

The NIS2 deadlines apply to essential and important entities under the Belgian NIS2 law, and only for a significant incident. The 72-hour data breach report under the GDPR applies to any organisation responsible for personal data.

← Free tools

FREE TOOL

Hit by a cyber attack? The clock is already running.

This free tool turns the moment you found out about a cyber incident into the exact Belgian NIS2 reporting deadlines: the 24-hour early warning, the 72-hour notification and the one-month final report to the CCB.

When did you find out?

The clock starts when you became aware of the incident, not when it began.

When did you send the 72-hour notification? (optional)

The final report counts from this moment. Leave it empty and we assume you notify at the last minute.

Personal data (customers, staff) may be involved

Your deadlines

This clock applies to essential and important entities under the Belgian NIS2 law, for a significant incident. It does not decide whether your incident is significant.

Report without delay. These are the latest moments the law allows, not the target.

Early warning to the CCB
23 h 59 min left
At the latest Sat, 7 Nov 2026, 15:26
Short: what happened, and do you suspect an attack or effects in other countries?
Incident notification to the CCB
2 d 23 h left
At the latest Mon, 9 Nov 2026, 15:26
Update the early warning, a first assessment of how serious it is and what it hits, and any signs of the attacker you have.
Final report to the CCB
32 d 23 h left
At the latest Wed, 9 Dec 2026, 15:26 (counted as if you notify at the 72-hour deadline; notify earlier and it comes earlier)
What happened in detail, the likely cause, what you did about it, effects in other countries. Still busy then? Send a progress report, and the final report within one month after you have dealt with it.

The CCB can also ask for an intermediate report at any time.

Where to report

CCB notification platform (notif.safeonweb.be)
CCB emergency line, for NIS2 entities only: +32 (0)2 501 05 60

Source: Belgian NIS2 law of 26 April 2024, art. 35; GDPR art. 33.

By Tom Janssens · Founder, Easy Cyber Protection · Last reviewed 3 November 2026 · How we write this

What is the NIS2 incident reporting rule?

Under the Belgian NIS2 law of 26 April 2024 (art. 35) [1], a company that falls under NIS2 reports a significant incident to the CCB, the Belgian cyber security centre, in three steps:

Early warning: Without delay, and within 24 hours of finding out: an early warning. Short. Do you suspect an attack, and could it affect other countries?
Incident notification: Without delay, and within 72 hours of finding out: the incident notification. A first view of how serious it is and what it hits.
Final report: Within one month of that notification (not of the incident): the final report, with the cause and what you did about it. Still busy then? Send a progress report, and the final report within a month after you have dealt with it.

If personal data of customers or staff may be involved, the GDPR (art. 33) [2] adds a separate report to the Data Protection Authority: without undue delay and where feasible within 72 hours.

The full set of deadlines, with examples, is covered on the NIS2 deadlines page.

What should I do in the first hour?

The PANIC sheet puts the first steps and these phone numbers on one page, to hang next to the screen.

Get the PANIC sheet →

Frequently asked questions

When does the 24-hour clock start?: When you become aware of the significant incident, not when the attack began. An attacker may have been inside for weeks; the 24 hours start the moment you find out.
Does the one month count from the incident?: No. The final report is due at the latest one month after you sent the 72-hour incident notification. If the incident is still going on by then, you send a progress report, and the final report within one month after you have dealt with it.
Where do I report a NIS2 incident in Belgium?: On the CCB notification platform, notif.safeonweb.be. NIS2 entities can also call the CCB emergency line on +32 (0)2 501 05 60. A personal data breach goes separately to the Data Protection Authority (GBA/APD).
Does this apply to my company?: The NIS2 deadlines apply to essential and important entities under the Belgian NIS2 law, and only for a significant incident. The 72-hour data breach report under the GDPR applies to any organisation responsible for personal data.

Related free tools

NIS2 directive in Belgium

Use this with your clients

Hit by a cyber attack? The clock is already running.

Your deadlines

Early warning to the CCB

Incident notification to the CCB

Final report to the CCB

Where to report

What is the NIS2 incident reporting rule?

What should I do in the first hour?

Frequently asked questions

Related free tools

Sources