Data Protection Update in Netherlands: Q4 2025

Netherlands data protection 2025 entered a more demanding phase in the fourth quarter, with the Dutch Data Protection Authority - the Autoriteit Persoonsgegevens (AP) - intensifying enforcement, issuing significant guidance, and signalling stricter scrutiny of AI-driven data processing. Businesses operating in the Netherlands, whether locally incorporated or serving Dutch residents from abroad, face a tighter compliance environment than at any point since the General Data Protection Regulation (GDPR) came into force. This guide covers the key regulatory and legislative developments of the quarter, the enforcement cases that set new practical benchmarks, the obligations that have changed or been clarified, and the concrete steps organisations should take to stay compliant.

The AP continued to act as one of the more proactive supervisory authorities in the European Economic Area during the fourth quarter. Several formal guidance documents and enforcement decisions were published, each carrying practical weight for controllers and processors established in or targeting the Netherlands.

The most significant regulatory development was the AP';s updated framework for assessing legitimate interest as a lawful basis under Article 6(1)(f) GDPR. The AP clarified that organisations relying on legitimate interest must conduct and document a three-part balancing test - purpose, necessity, and the interests of data subjects - before processing begins, not retrospectively. This position aligns with recent guidance from the European Data Protection Board (EDPB) but adds a Dutch-specific expectation: the documentation must be retained and made available to the AP on request within a short timeframe. Many organisations that had treated legitimate interest as a flexible fallback basis will need to revisit their records of processing activities (RoPAs) and update their legal basis assessments.

The AP also published a thematic investigation report on the use of tracking technologies, focusing on consent management platforms (CMPs). The report found that a material proportion of CMPs deployed on Dutch-facing websites failed to meet the standard set by the Telecommunications Act (Telecommunicatiewet) and the GDPR jointly. Specifically, the AP highlighted pre-ticked boxes, misleading colour schemes that nudged users toward acceptance, and the absence of a genuinely equal "reject all" option. Controllers relying on third-party CMP vendors should not assume vendor compliance; the AP made clear that the controller bears primary responsibility.

A further development concerns the Dutch implementation of the NIS2 Directive. Although NIS2 is primarily a cybersecurity instrument, its intersection with data protection is direct: a security incident that results in a personal data breach triggers obligations under both the NIS2 national implementing legislation and Article 33 GDPR. The AP and the National Cyber Security Centre (NCSC) issued a joint statement clarifying the notification pathways and the sequence of reporting obligations. Organisations in scope of NIS2 - which now covers a broader range of sectors than its predecessor - must ensure their incident response procedures address both regimes simultaneously.

The AP issued several enforcement decisions during the quarter, and the pattern across those decisions reveals the authority';s current priorities clearly.

One of the more prominent decisions involved a large retail group that had deployed a customer loyalty programme without conducting an adequate Data Protection Impact Assessment (DPIA) under Article 35 GDPR. The AP found that the profiling involved - combining purchase history, location data inferred from store visits, and third-party enrichment data - met the threshold for high-risk processing. The absence of a DPIA before deployment was treated as a standalone infringement, separate from any question of whether the processing itself was lawful. The fine issued was in the upper range for procedural violations, and the AP ordered the organisation to complete a retrospective DPIA and suspend certain profiling activities pending review. The practical signal is unambiguous: DPIA obligations are not a formality, and the AP will treat non-compliance as a substantive breach.

A second decision targeted a software-as-a-service provider acting as a data processor for multiple Dutch public-sector clients. The AP found that the processor';s standard data processing agreement (DPA) did not meet the requirements of Article 28 GDPR in several respects - most notably, it failed to specify the subject matter, duration, nature, and purpose of processing with sufficient precision, and it did not restrict sub-processing to an approved list. The AP issued a corrective order requiring the processor to revise all active DPAs within a defined period and imposed a fine for the period of non-compliance. This decision is particularly relevant for technology vendors serving Dutch clients: boilerplate DPA language that has not been reviewed against current AP expectations carries real enforcement risk.

A third enforcement action concerned international data transfers. The AP investigated a financial services firm that had transferred personal data to a third-country service provider relying on Standard Contractual Clauses (SCCs) without completing a Transfer Impact Assessment (TIA). Following the Schrems II ruling and the EDPB';s subsequent guidance, TIAs are a mandatory step before SCCs can be relied upon. The AP found that the firm had adopted the new SCCs but had not assessed whether the legal framework of the destination country offered equivalent protection. The decision reinforces that SCCs are a mechanism, not a guarantee, and that the TIA is the substantive safeguard.

In practice, founders and compliance officers should consider these three decisions as a combined signal: the AP is moving from awareness-raising to active enforcement across the full lifecycle of data processing - from legal basis and DPIA, through contractual arrangements, to international transfers.

The intersection of the GDPR and the Dutch Telecommunications Act (Telecommunicatiewet) remained a live compliance area throughout the quarter. The Netherlands has not yet adopted a standalone ePrivacy Regulation at EU level, so the Telecommunications Act continues to govern cookie consent and electronic communications alongside the GDPR.

The AP';s thematic report on CMPs, referenced above, was accompanied by an enforcement sweep. The AP sent formal letters to a number of website operators identified as using non-compliant consent flows, giving them a defined period to remediate or face fines. The letters were not published individually, but the AP confirmed the sweep publicly. This approach - targeted letters before public enforcement - is consistent with the AP';s recent practice and means that organisations may receive direct regulatory contact without prior public warning.

The AP';s current standard for valid cookie consent requires that:

• The consent request is presented before any non-essential cookies are set.
• Refusing consent is as easy as giving it, with a clearly visible "reject all" option at the first layer.
• Consent is granular, allowing users to accept or reject different categories of cookies separately.
• Consent records are maintained and can be demonstrated to the AP.

A common mistake among Dutch and international businesses operating Dutch-facing websites is assuming that a CMP that is certified or approved in another EU member state automatically satisfies Dutch requirements. The AP applies its own assessment criteria, and the Telecommunications Act adds a layer of national specificity that purely GDPR-focused compliance programmes may miss.

For organisations running subscription or e-commerce models, the quarter also brought renewed AP attention to the practice of "consent or pay" - offering users a choice between consenting to tracking or paying a fee for an ad-free experience. The AP';s position, consistent with EDPB guidance, is that consent obtained under financial pressure may not be freely given within the meaning of Article 7 GDPR. Businesses using this model should review whether their implementation genuinely preserves free choice or effectively coerces consent.

If your organisation is uncertain whether its consent architecture meets current AP expectations, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Artificial intelligence and automated decision-making occupied a significant portion of the AP';s published output during the quarter. The AP released a guidance document specifically addressing the use of AI systems that process personal data, framing its analysis around existing GDPR obligations rather than waiting for the EU AI Act to become fully applicable.

The guidance identifies several high-risk scenarios under Article 22 GDPR - which restricts solely automated decisions that produce legal or similarly significant effects - and clarifies that the AP interprets "similarly significant" broadly. Decisions affecting creditworthiness, insurance pricing, employment screening, and access to public services are all cited as falling within scope. Organisations using AI tools for any of these purposes must ensure that a human review mechanism is genuinely available, not merely nominal.

The AP also addressed the use of large language models (LLMs) and generative AI tools in business contexts. The guidance notes that when employees use third-party AI tools that process personal data - for example, by inputting customer information into a generative AI assistant - the organisation is acting as a controller and must have a lawful basis for that processing. The guidance warns that many standard terms of service for AI tools do not constitute adequate data processing agreements under Article 28 GDPR, leaving organisations exposed. Controllers should audit which AI tools their staff use, assess whether personal data is being processed, and ensure compliant contractual arrangements are in place.

A non-obvious requirement that the AP';s guidance highlights is the obligation to update privacy notices when new AI-based processing is introduced. Article 13 and 14 GDPR require controllers to inform data subjects of the logic involved in automated processing and its envisaged consequences. Many organisations update their AI tools without revisiting their privacy notices, creating a gap between actual processing and disclosed processing that the AP treats as a transparency violation.

Two practical scenarios illustrate the stakes. A Dutch HR technology company using an AI-based CV screening tool must conduct a DPIA, document the logic of the algorithm, provide candidates with meaningful information about the automated assessment, and ensure a human can review and override the outcome. A foreign e-commerce business targeting Dutch consumers with AI-driven personalised pricing must assess whether that pricing constitutes a similarly significant effect, document its legal basis, and update its privacy notice to describe the personalisation logic.

International data transfers remained a priority enforcement area for the AP in the fourth quarter, consistent with the broader European supervisory trend following the invalidation of the Privacy Shield framework and the adoption of the new SCCs by the European Commission.

The AP';s position on Standard Contractual Clauses is that they are a necessary but not sufficient safeguard. The Transfer Impact Assessment is the mechanism by which a controller satisfies itself - and can demonstrate to the AP - that the SCCs will be effective in practice given the legal and factual circumstances of the destination country. The AP expects TIAs to be documented, specific to the transfer in question, and updated when circumstances change - for example, when a destination country amends its surveillance laws or when the nature of the data transferred changes.

For organisations transferring data to processors or sub-processors in the United States, the EU-US Data Privacy Framework provides an alternative transfer mechanism for transfers to certified US organisations. However, the AP has noted that controllers must verify that the recipient organisation is currently certified and that the certification covers the categories of data and processing activities in question. Certification lapses or scope limitations are a common oversight.

Binding Corporate Rules (BCRs) remain available for intra-group transfers, but the approval process is lengthy and resource-intensive. The AP is a competent authority for BCR applications where the Netherlands is the lead supervisory authority. Organisations considering BCRs should factor in the realistic timeline and the level of documentation required before committing to this route.

Many underestimate the ongoing maintenance burden of transfer mechanisms. SCCs and TIAs are not one-time exercises; they require periodic review, particularly when the processing relationship changes or when new EDPB guidance is issued. A common mistake is treating the execution of SCCs as the end of the transfer compliance process rather than the beginning.

The developments of the quarter translate into a concrete set of actions for organisations subject to Dutch data protection law. The following priorities reflect both the AP';s stated enforcement focus and the practical gaps that the quarter';s decisions revealed.

Organisations should review their RoPAs to ensure that every processing activity has a documented lawful basis, that legitimate interest assessments are complete and on file, and that the RoPA reflects current processing rather than the state of affairs at the time of GDPR implementation. The AP has indicated that RoPA audits are part of its supervisory toolkit.

DPIA procedures should be assessed against the AP';s published list of processing types that require a DPIA under Dutch law. The AP has published a national list pursuant to Article 35(4) GDPR, and organisations should cross-reference their processing activities against that list regularly, particularly when introducing new technologies or expanding existing programmes.

Data processing agreements with vendors and sub-processors should be reviewed for compliance with Article 28 GDPR. The AP';s enforcement decision against the SaaS provider described above sets a clear standard: vague or generic DPA language is not acceptable. Agreements should specify the subject matter, duration, nature, and purpose of processing, and should restrict sub-processing to named or categorised sub-processors.

Consent management on digital properties should be audited against the AP';s current CMP standards. This includes reviewing the visual design of consent interfaces, the availability of a "reject all" option at the first layer, and the granularity of consent categories.

AI tool usage across the organisation should be inventoried. For each tool that processes personal data, the organisation should confirm that a compliant DPA is in place, that the processing is covered by a lawful basis, and that privacy notices are updated to reflect the processing.

International transfer documentation - SCCs, TIAs, and any reliance on the EU-US Data Privacy Framework - should be reviewed for completeness and currency.

For assistance with any of these compliance steps, contact info@vlolawfirm.com. We can assist with documents, assessments, and filings across the full range of data protection obligations.

Does the AP';s updated legitimate interest guidance require organisations to redo all existing legal basis assessments?

Not necessarily in every case, but organisations that have relied on legitimate interest without a documented three-part balancing test should conduct that assessment now and record it. The AP';s guidance does not have retroactive legal effect in the sense of automatically rendering past processing unlawful, but it sets the standard against which the AP will assess compliance going forward. If an organisation cannot produce a documented balancing test on request, it faces enforcement risk regardless of when the processing began. Organisations with large volumes of processing activities should prioritise the highest-risk categories - profiling, marketing, and employee monitoring - for immediate review.

How long does it typically take to complete a Transfer Impact Assessment, and what does it cost?

The time and cost of a TIA depend heavily on the complexity of the transfer and the destination country. A straightforward transfer to a single processor in a country with a well-documented legal framework can be assessed in a matter of days by an experienced practitioner. Transfers to countries with opaque surveillance laws, or transfers involving sensitive categories of data, require more detailed legal analysis and may take several weeks. Professional fees for a TIA typically start from the low thousands of EUR for a standard assessment. Organisations with many international transfers should consider developing a template TIA methodology that can be adapted for each transfer, reducing the per-transfer cost over time.

Is a "consent or pay" model lawful under Dutch data protection law?

The AP';s current position, aligned with EDPB guidance, is that a "consent or pay" model is not automatically unlawful but requires careful design to ensure that consent is freely given. The key question is whether the fee for the paid alternative is set at a level that genuinely preserves free choice or effectively compels most users to consent. The AP has indicated that it will assess these models on a case-by-case basis, taking into account the nature of the service, the size of the fee, and the availability of comparable free alternatives in the market. Organisations using this model should document their reasoning and be prepared to demonstrate to the AP that the fee level does not constitute undue pressure.

The fourth quarter reinforced that the Netherlands operates one of the more active data protection enforcement environments in the EU. The AP';s decisions on DPIAs, data processing agreements, and international transfers set clear benchmarks. Its guidance on AI, consent, and legitimate interest narrows the space for ambiguity. Organisations that treat compliance as a one-time exercise rather than an ongoing programme face material enforcement risk.

VLO Law Firms advises international clients on data protection matters in the Netherlands. We can assist with DPIA preparation, legal basis assessments, data processing agreements, transfer impact assessments, and regulatory correspondence with the AP. To request a consultation, contact: info@vlolawfirm.com