Netherlands data protection law is moving fast. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has intensified enforcement, new guidance has been issued under the General Data Protection Regulation (GDPR), and several legislative developments at both national and EU level are reshaping compliance obligations for businesses operating in the Netherlands. This guide covers the most significant regulatory updates, enforcement actions, and practical implications from the first quarter, giving controllers and processors a clear picture of what has changed and what they must do next.
The GDPR remains the primary legal framework, implemented in the Netherlands through the Uitvoeringswet AVG (UAVG). Recent months have seen the AP sharpen its focus on three areas: artificial intelligence and automated decision-making, cross-border data transfers, and the obligations of data processors under Article 28 GDPR.
The AP has published updated guidance on the use of AI tools that process personal data. The guidance clarifies that any AI system performing automated decision-making with legal or similarly significant effects on individuals must comply with Article 22 GDPR. Controllers must document the logic involved, provide meaningful information to data subjects, and ensure human oversight is genuinely available - not merely nominal. Businesses using AI-driven HR tools, credit-scoring systems, or customer profiling platforms should review their data protection impact assessments (DPIAs) in light of this guidance.
On cross-border transfers, the AP has aligned its position with the European Data Protection Board (EDPB) recommendations on supplementary measures. Transfers to third countries must be supported by a valid transfer mechanism - standard contractual clauses (SCCs), binding corporate rules, or an adequacy decision - and controllers must conduct a transfer impact assessment (TIA) where the legal framework of the destination country may undermine the protection offered by the SCCs. Many Dutch businesses have been slow to formalise TIAs, and the AP has signalled this is now an audit priority.
The AP has issued several significant decisions in the current period, reinforcing that enforcement is no longer limited to large technology companies. Mid-sized businesses, healthcare providers, and public bodies have all received formal decisions.
One notable decision concerned a healthcare organisation that failed to implement adequate access controls, allowing staff to view patient records beyond their clinical need. The AP found a violation of the data minimisation and integrity principles under Articles 5(1)(c) and 5(1)(f) GDPR. The fine was substantial, and the AP required the organisation to implement role-based access controls within a defined remediation period. The case underscores that technical and organisational measures must be proportionate to the sensitivity of the data processed.
A second enforcement action targeted a retail business that had failed to appoint a Data Protection Officer (DPO) despite processing special category data at scale. Under Article 37 GDPR and the UAVG, certain controllers are required to appoint a DPO. The AP found that the business had incorrectly assessed that no DPO was needed, relying on an outdated internal analysis. The regulator issued a corrective order and a financial penalty. Controllers should revisit their DPO necessity assessments whenever their processing activities change materially.
A common mistake among foreign-owned businesses is assuming that a DPO appointed in another EU member state satisfies Dutch requirements without any local coordination. In practice, the AP expects the DPO to be accessible to Dutch data subjects and to engage directly with the AP when required.
Beyond enforcement, several legislative and policy developments are directly relevant to businesses with Dutch operations.
The EU AI Act, which entered into force recently, introduces obligations that overlap significantly with GDPR. High-risk AI systems - as defined in Annex III of the AI Act - must undergo conformity assessments, maintain technical documentation, and implement human oversight mechanisms. Where such systems also process personal data, controllers face a dual compliance burden: satisfying both the AI Act and the GDPR simultaneously. The AP and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) are expected to coordinate supervision, but the precise division of responsibilities is still being clarified at national level.
The Network and Information Security Directive (NIS2), transposed into Dutch law through the Cyberbeveiligingswet, has expanded the scope of entities subject to cybersecurity obligations. Essential and important entities - including energy, transport, healthcare, and digital infrastructure operators - must now implement risk management measures, report significant incidents to the Nationaal Cyber Security Centrum (NCSC) within 24 hours of becoming aware, and ensure supply chain security. Where a cybersecurity incident also constitutes a personal data breach, the GDPR';s 72-hour notification obligation to the AP runs concurrently. Businesses must have integrated incident response procedures that satisfy both regimes simultaneously.
The AP has also updated its guidance on cookie consent, reflecting the EDPB';s recent opinion on consent management platforms. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, consent walls that deny access to services unless the user agrees to tracking, and bundled consent for multiple purposes all remain non-compliant. Businesses operating Dutch-facing websites should audit their consent management platforms against the updated guidance.
If you need assistance reviewing your compliance posture in light of these changes, contact info@vlolawfirm.com. We can help structure the review correctly the first time.
The cumulative effect of these developments is a materially higher compliance baseline for businesses operating in the Netherlands. Several practical steps follow directly from the regulatory picture described above.
Controllers should conduct a gap analysis against the AP';s updated AI guidance. If your organisation uses any automated system that influences decisions about individuals - whether in recruitment, lending, insurance, or marketing - you need a current DPIA that addresses the specific risks of that system. Generic DPIAs that were prepared when the system was first deployed are unlikely to reflect current processing realities.
Processors face increased scrutiny under Article 28. The AP has indicated that it will examine data processing agreements (DPAs) more closely, particularly in cases where the processor is a cloud service provider or an AI vendor. DPAs must specify the subject matter, duration, nature, and purpose of processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. Vague or template DPAs that do not reflect actual processing activities are a compliance risk.
Consider two practical scenarios. First, a Dutch e-commerce business using a US-based analytics platform must ensure it has valid SCCs in place, has conducted a TIA, and has implemented supplementary measures such as pseudonymisation or encryption where the TIA reveals risks. Second, a multinational with its EU headquarters in the Netherlands and processing operations across multiple member states must ensure its lead supervisory authority arrangements are correctly documented and that its record of processing activities (RoPA) under Article 30 GDPR is current and accurate.
A non-obvious requirement is that the RoPA must be made available to the AP on request without delay. Many businesses treat the RoPA as a one-time exercise rather than a living document. In practice, any material change to processing activities - a new vendor, a new product feature, a change in data retention periods - should trigger an update to the RoPA.
Many underestimate the interaction between the GDPR and sector-specific legislation. In the Netherlands, the healthcare sector is subject to additional requirements under the Wet op de geneeskundige behandelingsovereenkomst (WGBO) and the Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg. Financial services firms must also consider the requirements of the Dutch Financial Supervision Act (Wet op het financieel toezicht, Wft) alongside GDPR obligations. Compliance programmes that address only the GDPR without integrating sector-specific rules are incomplete.
The AP has received a growing volume of complaints related to data subject rights, particularly the right of access under Article 15 GDPR and the right to erasure under Article 17. Several recent decisions have found that organisations responded to access requests either too slowly - beyond the one-month deadline - or incompletely, failing to provide all the information required by Article 15(1).
Controllers must have operational procedures in place to identify, retrieve, and compile personal data in response to access requests within the statutory timeframe. Where the complexity or volume of requests justifies an extension, the controller may extend the response period by a further two months, but must notify the data subject within the first month and explain the reason for the delay. Failure to communicate the extension is itself a violation.
The right to erasure is frequently misunderstood. It does not apply where processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise, or defence of legal claims. Controllers should have a documented decision-making framework for assessing erasure requests, rather than granting or refusing them without analysis.
A common mistake is treating data subject rights as a customer service function rather than a legal compliance function. Requests should be handled by or under the supervision of the DPO or legal team, with a clear audit trail. The AP has found in several cases that organisations could not demonstrate how they had handled a request, which itself constituted a failure of accountability under Article 5(2) GDPR.
In practice, founders and compliance officers should consider whether their current systems allow them to locate all personal data relating to a specific individual across all processing systems. Many organisations discover during a data subject access request that their data is fragmented across legacy systems, third-party processors, and unstructured data stores, making a complete response difficult to compile within the deadline.
What are the most significant compliance risks for businesses in the Netherlands right now?
The AP';s current enforcement priorities centre on AI and automated decision-making, cross-border data transfers, and data processor agreements. Businesses that use AI tools affecting individuals, transfer data to non-EU countries, or rely on cloud-based processors face the highest immediate risk of regulatory scrutiny. Organisations should ensure their DPIAs are current, their SCCs are accompanied by TIAs, and their DPAs with processors accurately reflect actual processing. Failure to address these areas is likely to attract attention in the event of an AP audit or a data subject complaint.
How long does it take to bring a compliance programme into line with current AP expectations, and what does it cost?
The timeline depends heavily on the size and complexity of the organisation. A small business with straightforward processing activities may be able to complete a gap analysis and remediation within a few weeks. A larger organisation with multiple processing systems, international data flows, and sector-specific obligations may require several months of structured work. Professional fees for a comprehensive compliance review typically start from the low thousands of EUR for smaller engagements and rise significantly for complex, multi-jurisdictional programmes. Investing in compliance upfront is considerably less costly than responding to an AP investigation or a data breach.
Should a business with EU headquarters in the Netherlands use the AP as its lead supervisory authority?
Whether the AP is the correct lead supervisory authority depends on where the business has its main establishment within the EU - generally, where its central administration is located or where decisions about the purposes and means of processing are taken. If the Netherlands is genuinely the place of central administration and the main processing decisions are made there, the AP will typically be the lead authority for cross-border processing under the one-stop-shop mechanism. However, if significant processing decisions are made in another member state, a different authority may be the lead. This analysis should be documented carefully, as an incorrect lead authority designation can create procedural complications in enforcement proceedings.
The Dutch data protection landscape has become more demanding across every dimension - enforcement intensity, legislative scope, and regulatory guidance. Businesses operating in the Netherlands must treat compliance as an ongoing operational function, not a one-time project. Keeping DPIAs current, maintaining accurate RoPAs, and ensuring that AI tools and cross-border transfers are properly governed are the immediate priorities.
VLO Law Firms advises international clients on data protection matters in the Netherlands. We can assist with GDPR gap analyses, DPIA preparation, data processing agreements, DPO support, and regulatory correspondence with the AP. To request a consultation, contact: info@vlolawfirm.com