ESRS Content index
Please note that the page references in the table below pertain to the PDF version of this report, which can be downloaded in the menu bar above.
# |
Description |
Reference(s) |
Explanatory notes |
---|---|---|---|
ESRS 2: General disclosures (July 2023) |
|||
BP-1 |
General basis for preparation of the sustainability statements |
Annex 2, 1.1 Scope (p. 117) |
Our strategy contains both financial and non-financial provisions. We don't disclose some of our financial strategic targets for reasons of confidentiality |
BP-2 |
Disclosures in relation to specific circumstances |
Annex 2, sub 1.1 Scope (p. 117) |
There are no other specific circumstances than referenced |
GOV-1 |
The role of the administrative, management and supervisory bodies |
Roles and responsibilities (p. 33-34) |
Representatives from employees and other workers are not represented in the Board |
Profile Supervisory Board Deloitte Netherlands |
https://www2.deloitte.com/content/dam/Deloitte/nl/Documents/about-deloitte/deloitte-nl-profile-supervisory-board.pdf |
||
GOV-2 |
Information provided to and sustainability matters addressed by the undertaking’s administrative, management and supervisory bodies |
Report of the Supervisory Board (p. 35-41) |
|
GOV-3 |
Integration of sustainability-related performance in incentive schemes |
Deloitte has not yet systematically included sustainability-related performance in incentive schemes |
|
GOV-4 |
Statement on sustainability due diligence |
Annex 2, 5.3 Human rights (p. 184-185) |
|
GOV-5 |
Risk management and internal controls over sustainability reporting |
Annex 2, 1.5 Reporting process (p. 123) |
|
SBM-1 |
Market position, strategy, business model(s) and value chain |
Our businesses and industries (p. 21) |
ESRS-2 40c-d: Deloitte operates across all sectors, but always in audit or advisory roles. Clients can operate in sectors mentioned in these requirements |
SBM-2 |
Interests and views of stakeholders |
Annex 2, 1.2 Materiality (p. 117-123) |
ESRS-2 45c not applicable as we have not changed our strategy |
SBM-3 |
Material impacts, risks and opportunities and their interaction with strategy and business model(s) |
Annex 2: 1.2 Materiality (p. 121-122) |
Impacts, risks and opportunities are disclosed at the beginning of every paragraph dealing with a material sustainability matter Initiatives taken to reduce current negative impacts. Risks and opportunities are described in the sections where we disclose information on our material sustainability impacts thoughout the report; |
IRO-1 |
Description of the processes to identify and assess material impacts, risks and opportunities |
Annex 2, 1.2 Materiality (p. 117-123) |
Risk management (p. 49-50) |
IRO-2 |
Disclosure Requirements in ESRS covered by the undertaking’s sustainability statements |
Annex 3, ESRS Content index (p. 194-203) |
ESRS-2 58: Brief explanation concerning non-materiality for E2, E3, E4 and E5 is provided |
MDR-P |
Policies adopted to manage material sustainability matters |
All material topics are disclosed taking the MDR taking into account. Possible deviations are disclosed in the ESRS Content Index |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
All material topics are disclosed taking the MDR taking into account. Possible deviations are disclosed in the ESRS Content Index |
|
MDR-M |
Metrics in relation to material sustainability matters |
All material topics are disclosed taking the MDR taking into account. Possible deviations are disclosed in the ESRS Content Index |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
All material topics are disclosed taking the MDR taking into account. Possible deviations are disclosed in the ESRS Content Index |
|
ESRS E1: Climate change (July 2023) |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 2.1 Climate and CO2 (p. 125, 132-134) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 1.3 Reporting boundaries (p. 123) |
ESRS 2-69: There are no plans that require significant operational or capital expenditures. All costs of climate programmes are absorbed in our normal planning cycle |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 2.1 Climate and CO2 (p. 132, 138-141) |
Both ESRS defined and entity specific metrics have been included in the report |
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 2.1 Climate and CO2 (p. 125, 132, 139-142) |
WorldClimate is a top-down programme where we consult with stakeholder how we approach the actions prescribed |
ESRS-2 |
Disclosure requirement related to ESRS 2 GOV-3 Integration of sustainability-related performance in incentive schemes |
Annex 2, 2.1 Climate and CO2 (p. 132) |
|
E1-1 |
Transition plan for climate change mitigation |
Annex 2, 2.1 Climate and CO2 (p. 133, 113) |
ESRS-E1 16c: As Deloitte is asset-light, we don't foresee funding that requires capital investments |
ESRS-2 |
Disclosure Requirement related to ESRS 2 SBM-3 – Material impacts, risks and opportunities and their interaction with strategy and business model |
Annex 2, 2.1 Climate and CO2 (p. 125-131) |
|
ESRS-2 |
Disclosure requirement related to ESRS 2 IRO-1 – Description of the processes to identify and assess material climate-related impacts, risks and opportunities |
Annex 2, 1.2 Materiality (p. 117-123) |
|
E1-2 |
Policies related to climate change mitigation and adaptation |
Annex 2, 2.1 Climate and CO2 (p. 132-134) |
|
E1-3 |
Actions and resources in relation to climate change policies |
Annex 2, 2.1 Climate and CO2 (p. 132-134, 134-137, 139-141) |
We do not foresee there to be significant CapEx or OpEx consequences to our Climate strategy on the short to medium term |
E1-4 |
Targets related to climate change mitigation and adaptation |
Annex 2, 2.1 Climate and CO2 (p. 132-134, 139) |
We are still developing our transition plan to reach net zero by 2040. Pathways per scope will be disclosed once this transition plan has been adopted. |
E1-5 |
Energy consumption and mix |
Annex 2, 2.1 Climate and CO2 (p. 140-141) |
ESRS-E1 38-43 Not applicable to Deloitte as we don't have activities in high climate impact sectors |
E1-6 |
Gross Scopes 1, 2, 3 and Total GHG emissions |
Annex 2, 2.1 Climate and CO2 (p. 138-139) |
|
E1-7 |
GHG removals and GHG mitigation projects financed through carbon credits |
Annex 2, 2.1 Climate and CO2 (p. 134) |
Programme is operated by Deloitte NSE on behalf of its geographies and reported on in their Impact report. It is therefore not in scope for Deloitte NL reporting |
E1-8 |
Internal carbon pricing |
Annex 2, 2.1 Climate and CO2 (p. 141) |
ESRS-E1 63: Not applicable as Deloitte does not (yet) use internal carbon pricing |
E1-9 |
Anticipated financial effects from material physical and transition risks and potential climate-related opportunities |
Annex 2, 2.1 Climate and CO2 (p. 127-131) |
ESRS-E1 66c: There are no assets at material physical risk |
Relevant Application requirements |
|||
AR 4 |
Taxonomy-aligned revenue is not yet mandatory for Deloitte to report on |
||
AR 5 |
Not applicable as Deloitte is not included in the EU Paris-aligned Benchmarks |
||
AR 6-8 |
Annex 2, 2.1 Climate and CO2 (p. 125-131) |
||
AR 9 |
Annex 2, 1.2 Materiality (p. 117) |
||
AR 11-18 |
Annex 2, 2.1 Climate and CO2 (p. 125-131) |
ESRS-E1 AR18: Climate change physical and transition risks are negligible |
|
AR 19-22 |
Annex 2, 2.1 Climate and CO2 (p. 133-138) |
ESRS-E1 AR 19b: Although we address many of these types of mitigation actions, we have not aggregated them |
|
AR 24-30 |
Annex 2, 2.1 Climate and CO2 (p. 126-131, 132-134, 139) |
We are still developing our transition plan to reach net zero by 2040. Pathways per scope will be disclosed once this transition plan has been adopted. |
|
AR 32-35 |
Annex 2, 2.1 Climate and CO2 (p. 140) |
ESRS-E1 AR 32a: Scope 1 and 2 emissions are only reported where we have operational control and have the responsibility for the purchase of energy |
|
AR 39-44 |
Annex 3, Basis of reporting (p. 189-193) |
ESRS-E1 AR 39a: Our definitions are based on GHG Protocol to facilitate CDP submission of DTTL |
|
AR 45 |
Annex 2, 2.1 Climate and CO2 (p. 139) |
Our Scope 2 emissions include bought electricity (for offices and fleet) and heat. Steam and cooling are not applicable to Deloitte |
|
AR 46 |
Annex 2, 2.1 Climate and CO2 (p. 138-139) |
ESRS-E1 AR 46c: Screening is done on the level of DTTL and NSE |
|
AR 47-52 |
Annex 2, 2.1 Climate and CO2 (p. 139) |
ESRS-E1 AR 48: Total reduction targets are not provided pending the finalisation of our Transition plan |
|
AR 53-55 |
Annex 2, 2.1 Climate and CO2 (p. 139) |
||
AR 56-60 |
Not applicable as we do not engage in these activities |
||
AR 61-64 |
We don't report on carbon credits as this activity is NSE-led |
||
AR 65-66 |
Not applicable as Deloitte does not (yet) have an internal carbon price mechanism |
||
AR 67-71 |
Annex 2, 2.1 Climate and CO2 (p. 127-131) |
AR 70: No assets at material physical risks hence not disclosed |
|
AR 72 |
We do not believe our revenue to be at risk due to physical climate risks in the short or medium term as our business is volatile and climate opportunities exceed climate risks. For the longer term, together with our NSE partners, we will further investigate what our clients’ exposure is to physical climate risks and we will assess what the potential impact is on their business continuity. |
||
AR 73 |
ESRS-E1 AR 73a: Not applicable as there are no assets at material transition risk |
||
AR 74 |
Deloitte does not operate installations regulated under an emission trading scheme |
||
AR 76 |
We do not believe our revenue to be at risk due to physical climate risks in the short or medium term as our business is volatile and climate opportunities exceed climate risks. For the longer term, together with our NSE partners, we will further investigate what our clients’ exposure is to physical climate risks and we will assess what the potential impact is on their business continuity. |
||
AR 77-78 |
Not applicable to Deloitte as these risks are negligible and Deloitte's asset base is relatively small |
||
AR 79 |
Not applicable to Deloitte as we are not part of emission trading schemes |
||
Ar 80-81 |
Not applicable to Deloitte |
||
Entity specific metrics |
|||
Reducing of business travel emissions per FTE from 2019 levels |
Annex 2, 2.1 Climate and CO2 (p. 132) |
||
Sourcing renewable energy for our buildings |
Annex 2, 2.1 Climate and CO2 (p. 132) |
||
Conversion of fleet to electric vehicles |
Annex 2, 2.1 Climate and CO2 (p. 132) |
||
ESRS S1: Own workforce (July 2023) |
|||
ESRS-2 |
Disclosure Requirement related to ESRS 2 SBM-3 – Material impacts, risks and opportunities and their interaction with strategy and business model |
Value creation (p. 12-13) |
Annex 2, Impacts, risks and opportunities in sub-sections 3.1, 3.2, 3.3 and 3.4 describes positive and negative impacts |
S1-1 |
Policies related to own workforce |
Annex 2, 3 Social impacts (p. 145-147, 149-150, 155-156, 158-159) |
All policies pertaining to material impacts on our own workforce, as well as associated risks and opportunities are described in paragraphs 3.1, 3.2, 3.3 and 3.4 |
S1-2 |
Processes for engaging with own workforce and workers’ representatives about impacts |
Annex 2, 3 Social Impacts: Introduction (p. 144) |
ESRS-S1 27d and 27e: Not applicable to Deloitte |
S1-3 |
Processes to remediate negative impacts and channels for own workforce to raise concerns |
Annex 2, 4.2 Ethics and integrity (p. 173-174) |
ESRS-S1 34: Not applicable |
S1-4 |
Taking action on material impacts on own workforce, and approaches to managing material risks and pursuing material opportunities related to own workforce, and effectiveness of those actions |
Annex 2, 3 Social Impacts: Introduction (p. 144-145, 147, 150-151, 156,159-160) |
MDRs are incorpporated in the disclosures of our material sustainability matters |
S1-5 |
Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities |
Annex 2, 3 Social Impacts:Introduction (p. 144-145, 148, 152, 157, 160) |
MDRs are incorpporated in the disclosures of our material sustainability matters |
S1-6 |
Characteristics of the undertaking’s employees |
Annex 2, 3 Introduction (p. 143-144) |
ESRS-S1 50e: Where applicable, contextual infromation is provided |
S1-7 |
Characteristics of non-employees in the undertaking’s own workforce |
Annex 2, 3 Social Impacts: Introduction (p. 143-144) |
ESRS-S1 57: Data is available and reported |
S1-8 |
Collective bargaining coverage and social dialogue |
Annex 2, 3 Social Impacts: introduction (p. 143-144) |
ESRS-S1 60-62: Not applicable as there are no collective bargaining agreements within Deloitte |
S1-9 |
Diversity metrics |
Annex 2, 3.2 Diversity, equity and inclusion (p. 151-153) |
|
S1-13 |
Training and skills development metrics |
Annex 2, 3.1 Employee value proposition (p. 147) |
Each employee has one formal performance review per year, hence we report the % of employees that have had a performance review |
S1-15 |
Work-life balance metrics |
Annex 2, 2.4 Wellbeing (p. 157) |
|
S1-16 |
Remuneration metrics (pay gap and total remuneration) |
Annex 2, 3.2 Diversity, equity and inclusion (p. 151-153) |
|
Relevant Application requirements |
|||
AR 10 |
There were no significant changes in policies in the reporting year with the exception the adoption of the Human Rights Policy that is included in section 5.3 and that has not (yet) led to significant changes in our approach to our own workforce. |
||
AR 12 |
Annex 2, 5.3 Human rights (p. 184-185) |
This is the case for the Deloitte and the Deloitte NL Human Rights Policy Statements and is disclosed in section 5.3 |
|
AR13 |
Annex 2, 5.2 Sustainable procurement (p. 182-183) |
||
AR 57 |
Annex 3, Basis of reporting (p. 191) |
We report average employees in the reporting year |
|
AR 59 |
Annex 3, Basis of reporting (p. 191) |
||
Employee Value Proposition |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.1 Employee value proposition (p. 144-147) |
ESRS-2 65d: Third party standards are not referenced |
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.1 Employee value proposition (p. 147) |
ESRS-2 68d: Implementation and upholding of our EVP is a continuous process hence no time horizons are set |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.1 Employee value proposition (p. 147-148) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.1 Employee value proposition (p. 148) |
|
Diversity, equity and inclusion |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.2 Diversity, equity and inclusion (p. 148-150) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.2 Diversity, equity and inclusion (p. 148-151) |
ESRS-2 69: DE&I activities are part of normal operational planning meaning that costs are planned for and allocated in the current financial year |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.2 Diversity, equity and inclusion (p. 152-154) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.2 Diversity, equity and inclusion (p. 152) |
|
Entity specific metrics |
|||
Female partners as % of total partners |
Annex 2, 3.2 Diversity, equity and inclusion (p. 152) |
||
Women in leadership positions |
Annex 2, 3.2 Diversity, equity and inclusion (p. 152) |
||
Learning and development |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.3 Learning and development (p. 155-156) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.3 Learning and development (p. 156) |
ESRS-2 69: Learning and development activities are part of normal operational planning meaning that costs are planned for and allocated on the current financial year |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.3 Learning and development (p. 158) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.3 Learning and development (p. 157) |
|
Wellbeing |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.4 Wellbeing (p. 158-159) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.4 Wellbeing (p. 160-161) |
ESRS-2 69: Wellbeing activities are part of normal operational planning meaning that costs are planned for and allocated on the current financial year |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.4 Wellbeing (p. 157, 160) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.4 Wellbeing (p. 160) |
ESRS-2 80: The metrics used are not suited to setting quantitative targets that are relevant for the activities in scope |
Entity specific metric |
|||
Sickness leave |
Annex 2, 3.4 Wellbeing (p. 160) |
||
Social impact and social return |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.5 Social impact / social return (p. 161-162, 164-166) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.5 Social impact / social return (p. 162-164, 165-167) |
ESRS-2 68: The policies of Deloitte Impact Foundation do not require specific actions other than what is mentioned in the Governance and Policies sections |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.5 Social impact / social return (p. 164) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.5 Social impact / social return (p. 160) |
|
Entity specific metrics |
|||
Hours spent on DIF Projects |
Annex 2, 3.5 Social impact / social return (p. 164) |
||
# DIF projects |
Annex 2, 3.5 Social impact / social return (p. 164) |
||
# employees involved in DIF projects |
Annex 2, 3.5 Social impact / social return (p. 164) |
||
ESRS S2: Workers in the value chain (July 2023) |
|||
Workers in the value chain |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 3.6 Workers in the value chain (p. 168) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 3.6 Workers in the value chain (p. 168-169) |
ESRS-2 69: Workers in the value chain activities are part of normal operational plan meaning that costs are planned for and allocated on the current financial year |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 3.6 Workers in the value chain (p. 168) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 3.6 Workers in the value chain (p. 169) |
|
ESRS 2 SBM-2 |
Interests and views of stakeholders |
Annex 2, 3.6 Workers in the value chain (p. 168-169) |
|
ESRS 2 SBM-3 |
Material impacts, risks and opportunities and their interaction with strategy and business model |
Value creation model (p. 13) |
|
S2-1 |
Policies related to value chain workers |
Annex 2, 3.6 Workers in the value chain (p. 168) |
|
S2-2 |
Processes for engaging with value chain workers about impacts |
This is outside our definition of material impacts |
|
S2-3 |
Processes to remediate negative impacts and channels for value chain workers to raise concerns |
Annex 2, 3.6 Workers in the value chain (p. 168) |
|
S2-4 |
Taking action on material impacts on value chain workers, and approaches to managing material risks and pursuing material opportunities related to value chain workers, and effectiveness of those actions |
Annex 2, 3.6 Workers in the value chain (p. 168) |
Activities are part of normal operational plan and staffing meaning that resources are planned for and allocated on the current financial year. No specific resources are allocated to the management of two positive material impacts |
S2-5 |
Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities |
No quantitative targets and KPIs are set at this moment |
|
AR 27 |
As no reports were filed by value chain workers to date, we cannot (yet) assess the effectiveness of the channels for value chain workers to raise concerns |
||
ESRS G1: Business conduct (July 2023) |
|||
ESRS-2 GOV-1 |
Disclosure Requirement related to ESRS 2 GOV-1 – The role of the administrative, management and supervisory bodies |
Annex 2, 4. Governance impacts (p. 170) |
ESRS-2 5b: Not specifically disclosed. See general sections in Roles and reponsibilities section and in Report of the Supervisory Board |
ESRS-2 |
Disclosure Requirement related to ESRS 2 IRO-1 – Description of the processes to identify and assess material impacts, risks and opportunities |
Anex 2, 4. Governnce impacts (p. 170, 173-174, 178) |
Per section in Chapter 4. Governance impacts, the relevant IROs have been disclosed |
G1-1 |
Business conduct policies and corporate culture |
Annex 2, 4.2 Ethics and integrity (p. 174-175, 178-179) |
ESRS-G1 10h: We believe all partners and employees are at a certain degree of risk and therefore have a training programme that is cross-functional |
G1-3 |
Procedures to address corruption and bribery |
Annex 2, 4.2 Ethics and integrity (p. 178-179) |
ESRS-G1 18c: We regard any incident involving corruption as an ethical incident. All ethical incidents are reported to the Executive Board |
G1-4 |
Incidents of corruption or bribery |
Annex 2, 4.2 Ethics and integrity (p. 178) |
|
Quality |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, 4.1 Quality (p. 170-171) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 4.1 Quality (p. 170-172) |
ESRS-2 68c: Actions take place on an ongoing basis |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 4.1 Quality (p. 170, 172) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 4.1 Quality (p. 170, 172) |
ESRS-2 No new targets have been set yet |
Entity specific metrics |
|||
Satisfactory regulatory reviews |
Annex 2, 4.1 Quality (p. 172) |
||
Client satisfaction score |
Annex 2, 4.1 Quality (p. 172) |
||
Net promotor score as measured by Client Satisfaction Assessments |
Annex 2, 4.1 Quality (p. 172) |
||
Ethics and integrity |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, Governance impacts (p. 170) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 4.2 Ethics and integrity (p. 176-177) |
ESRS-2 68c: Actions take place on an ongoing basis (e.g. annual ethics survey, two-yearly refreshers, etc) |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 4.2 Ethics and integrity (p. 178) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 4.2 Ethics and integrity (p. 177, 178) |
ESRS-2 80: We feel that ethics metrics are not suited for outcome oriented target setting |
Entity specific metrics |
|||
Incidents: number of reported occurance |
Annex 2, 4.2 Ethics and integrity (p. 177) |
||
Data security and privacy |
|||
MDR-P |
Policies adopted to manage material sustainability matters |
Annex 2, Governance impacts (p. 170) |
|
MDR-A |
Actions and resources in relation to material sustainability matters |
Annex 2, 4.3 Data security and privacy (p. 179-180) |
ESRS-2 68c: Actions take place on an ongoing basis |
MDR-M |
Metrics in relation to material sustainability matters |
Annex 2, 4.3 Data security and privacy (p. 180) |
|
MDR-T |
Tracking effectiveness of policies and actions through targets |
Annex 2, 4.3 Data security and privacy (p. 180) |
ESRS-2 80: No outcome oriented or time-bound targets have been set for data security and privacy |
Entity specific metrics |
|||
Total internally reported incidents |
Annex 2, 4.3 Data security and privacy (p. 180) |
||
Total internally reported incidents involving personal data |
Annex 2, 4.3 Data security and privacy (p. 180) |
||
# Complaints regarding breaches of client privacy or loss of customer data |
Annex 2, 4.3 Data security and privacy (p. 180) |
||
# Instance that personal data breaches were reported to the supervisory authority |
Annex 2, 4.3 Data security and privacy (p. 180) |