Data Protection & Privacy in Netherlands

The Netherlands enforces the General Data Protection Regulation (GDPR) directly and supplements it through the Uitvoeringswet Algemene Verordening Gegevensbescherming (UAVG), the Dutch implementation act. Any business processing personal data of individuals in the Netherlands - whether established locally or operating remotely - must comply with both instruments. Non-compliance exposes organisations to administrative fines reaching EUR 20 million or 4% of global annual turnover, whichever is higher. This article maps the legal framework, explains the key compliance tools, identifies the most common pitfalls for international operators, and sets out practical strategies for managing data protection risk in the Netherlands.

The GDPR applies in the Netherlands as directly binding EU law. The UAVG fills the spaces where the GDPR permits national derogations. Together, they govern lawful processing, data subject rights, controller and processor obligations, and enforcement.

The Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, is the competent supervisory authority. The AP investigates complaints, conducts audits, issues binding decisions and imposes administrative fines. It also publishes guidance that, while not legally binding, reflects the AP's enforcement priorities and is treated as authoritative by Dutch courts.

Under Article 5 GDPR, personal data must be processed lawfully, fairly and transparently, collected for specified and explicit purposes, limited to what is necessary, kept accurate, stored no longer than necessary, and protected with appropriate security. These six principles form the backbone of any compliance programme.

The UAVG, in Articles 22 through 30, introduces Dutch-specific rules on processing sensitive data, including health data, criminal records and citizen service numbers (BSN). Processing BSN outside contexts explicitly permitted by Dutch law - such as employment tax administration - is prohibited. International businesses frequently overlook this restriction when building HR or identity-verification systems.

The AP has enforcement powers under Article 83 GDPR and Articles 14 and 15 UAVG. It can issue warnings, reprimands, orders to bring processing into compliance, temporary or permanent bans on processing, and fines. The AP has demonstrated a willingness to use the full range of these powers, including against large technology companies and public bodies.

Every processing activity requires a lawful basis under Article 6 GDPR. The six available bases are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Choosing the wrong basis - or failing to document the choice - is one of the most common and costly mistakes made by international operators entering the Dutch market.

Consent under Article 7 GDPR must be freely given, specific, informed and unambiguous. In the Netherlands, the AP applies a strict interpretation of 'freely given,' particularly in employment contexts. Because of the power imbalance between employer and employee, consent is rarely a valid basis for processing employee data. Controllers relying on consent in employment must be able to demonstrate that refusal carries no adverse consequences - a standard that is difficult to meet in practice.

Legitimate interests under Article 6(1)(f) GDPR require a three-part balancing test: identify the legitimate interest, assess whether processing is necessary, and weigh that interest against the data subject's rights and freedoms. The AP expects this analysis to be documented in writing before processing begins, not reconstructed after a complaint is filed. A common mistake is treating legitimate interests as a catch-all basis when consent is inconvenient.

For special categories of data - health, biometric, genetic, racial or ethnic origin, religious beliefs, trade union membership, sexual orientation - Article 9 GDPR applies a higher threshold. Processing is prohibited unless one of the explicit exceptions applies. In the Netherlands, Article 22 UAVG permits processing health data for employment-related medical assessments, but only by or under the supervision of a registered healthcare professional. Employers who process employee health data without this safeguard face both GDPR enforcement and potential liability under Dutch employment law.

A non-obvious risk arises with cookie consent. The AP enforces the Telecommunicatiewet (Telecommunications Act), which implements the ePrivacy Directive in the Netherlands. Under Article 11.7a of the Telecommunications Act, placing non-essential cookies requires prior, informed consent. The AP has issued guidance specifying that cookie walls - where access to a website is conditional on accepting tracking cookies - are generally unlawful unless a genuine free alternative is offered. Businesses operating Dutch-facing websites must audit their consent management platforms against this standard.

To receive a checklist for lawful basis selection and consent management in the Netherlands, send a request to info@vlo.com.

The GDPR grants data subjects eight core rights: access, rectification, erasure, restriction of processing, data portability, objection, rights related to automated decision-making, and the right not to be subject to solely automated decisions with significant effects. Dutch data subjects are active in exercising these rights, and the AP receives a significant volume of complaints arising from inadequate responses.

Under Article 12 GDPR, controllers must respond to data subject requests without undue delay and within one month of receipt. Where requests are complex or numerous, the deadline may be extended by a further two months, but the controller must notify the data subject of the extension within the initial one-month period and explain the reasons. Failure to respond within the deadline is itself a violation, independent of whether the underlying processing was lawful.

The right of access under Article 15 GDPR entitles data subjects to receive a copy of their personal data and supplementary information about how it is processed. In practice, this right is frequently invoked in employment disputes and commercial litigation. A non-obvious risk is that access requests can function as pre-litigation discovery tools. Controllers who have not maintained accurate records of their processing activities will struggle to respond comprehensively and may inadvertently disclose inconsistencies that strengthen a claimant's position.

The right to erasure under Article 17 GDPR - commonly called the 'right to be forgotten' - applies where data is no longer necessary for the original purpose, consent is withdrawn and no other basis applies, or the data subject objects and the controller has no overriding legitimate grounds. Erasure obligations interact with Dutch retention requirements under the Archiefwet (Archives Act) and sector-specific rules, such as the seven-year retention period for financial records under the Wet op de vennootschapsbelasting (Corporate Tax Act). Controllers must map these competing obligations before implementing erasure procedures.

Data portability under Article 20 GDPR applies only where processing is based on consent or contract and is carried out by automated means. The AP has clarified that portability requests must be fulfilled in a structured, commonly used and machine-readable format. Controllers who store data in proprietary formats that cannot be exported without significant technical effort face both compliance risk and reputational exposure.

Practical scenario one: a Dutch consumer submits an access request to an e-commerce business headquartered outside the EU. The business has no EU establishment and has not appointed an EU representative under Article 27 GDPR. The AP treats the absence of an EU representative as a separate violation, compounds the response-time failure, and opens a broader investigation into the business's compliance posture. The cost of appointing a representative - modest in absolute terms - is far lower than the cost of this sequence of events.

A personal data breach is defined in Article 4(12) GDPR as a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The definition is broad and covers not only cyberattacks but also accidental emails sent to wrong recipients, lost devices and unauthorised internal access.

Under Article 33 GDPR, controllers must notify the AP of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Where notification is not made within 72 hours, the controller must provide reasons for the delay. The 72-hour clock starts when the controller - not a processor - becomes aware of the breach. Controllers who rely on processors must ensure their data processing agreements include contractual obligations for the processor to notify the controller promptly, typically within 24 hours, to preserve the controller's ability to meet the 72-hour deadline.

The AP notification must include, at minimum: a description of the nature of the breach; the categories and approximate number of data subjects and records affected; the name and contact details of the data protection officer or other contact point; a description of the likely consequences; and a description of the measures taken or proposed to address the breach. Where not all information is available within 72 hours, the GDPR permits phased notification, but the initial notification must be submitted within the deadline.

Under Article 34 GDPR, controllers must also notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The AP has issued guidance indicating that breaches involving financial data, health data, login credentials or data of vulnerable individuals typically meet the high-risk threshold. Notification to data subjects must be in clear and plain language and must include specific information about the nature of the breach and recommended protective measures.

A common mistake is treating breach response as a purely technical matter. Legal counsel should be involved from the moment a potential breach is identified, both to assess notification obligations and to manage legal privilege over internal investigations. In the Netherlands, communications between a lawyer and client are protected by professional secrecy under Article 218 of the Wetboek van Strafvordering (Code of Criminal Procedure), but this protection does not extend to communications with non-lawyer advisers.

Practical scenario two: a mid-sized Dutch manufacturer discovers that a ransomware attack has encrypted files containing personal data of approximately 5,000 employees and customers. The IT team spends 48 hours attempting to restore systems before informing legal counsel. By the time legal counsel is engaged, the 72-hour notification window has effectively closed. The AP investigates, finds both the breach and the delayed notification, and issues a fine. Had legal counsel been notified within hours of discovery, the notification could have been submitted on time, and the fine for delayed notification avoided.

To receive a checklist for data breach response and AP notification in the Netherlands, send a request to info@vlo.com.

Transferring personal data outside the European Economic Area (EEA) requires a legal transfer mechanism under Chapter V GDPR. The available mechanisms are: an adequacy decision by the European Commission; Standard Contractual Clauses (SCCs) adopted by the Commission; Binding Corporate Rules (BCRs); approved codes of conduct with binding commitments; approved certification mechanisms; or, for occasional transfers, the derogations in Article 49 GDPR.

The European Commission has adopted adequacy decisions for a limited number of countries, including the United Kingdom (subject to periodic review), Switzerland, Japan, South Korea and several others. Transfers to the United States are governed by the EU-US Data Privacy Framework, an adequacy decision adopted following the invalidation of Privacy Shield by the Court of Justice of the European Union. Controllers transferring data to US-based processors or sub-processors must verify that the recipient is certified under the Data Privacy Framework or implement alternative transfer mechanisms.

SCCs are the most widely used transfer mechanism for transfers to non-adequate third countries. The current SCCs, adopted by the Commission in June 2021, cover four transfer scenarios: controller-to-controller, controller-to-processor, processor-to-controller and processor-to-processor. Controllers must select the appropriate module and complete the annexes accurately. A common mistake is using outdated SCCs - the pre-2021 versions - which are no longer valid for new contracts.

Under Article 46(1) GDPR and the guidance of the European Data Protection Board (EDPB), controllers must conduct a Transfer Impact Assessment (TIA) before relying on SCCs. The TIA evaluates whether the legal framework of the destination country provides essentially equivalent protection to the GDPR. The AP expects TIAs to be documented and available for inspection. Controllers who cannot produce a TIA when requested face enforcement risk independent of whether the underlying transfer was actually harmful.

BCRs are available for intra-group transfers within multinational corporate groups. The AP is one of the competent supervisory authorities for approving BCRs where the lead establishment is in the Netherlands. The BCR approval process is lengthy - typically 12 to 18 months - and requires detailed documentation of the group's data flows, governance structure and enforcement mechanisms. BCRs are appropriate for large groups with stable structures; for smaller groups or joint ventures, SCCs are more practical.

The Article 49 derogations - including consent, contract performance and vital interests - are intended for occasional transfers only. The AP and the EDPB have consistently held that systematic or large-scale transfers cannot rely on derogations. Controllers who use consent as a transfer mechanism for routine commercial data flows are exposed to enforcement action.

Practical scenario three: a Dutch fintech company uses a US-based cloud provider to process customer payment data. The company has executed SCCs with the provider but has not conducted a TIA and has not verified whether the provider's sub-processors are located in adequate countries. The AP, acting on a complaint from a customer, requests documentation of the transfer mechanism. The company cannot produce a TIA and discovers that two sub-processors are located in countries without adequacy decisions and without SCCs. The remediation cost - legal fees, renegotiation of contracts, technical reconfiguration - significantly exceeds what a proactive compliance review would have cost.

The Data Protection Officer (DPO) is a mandatory role under Article 37 GDPR for: public authorities and bodies; controllers or processors whose core activities require large-scale, regular and systematic monitoring of data subjects; and controllers or processors whose core activities involve large-scale processing of special categories of data or data relating to criminal convictions. In the Netherlands, the AP has clarified that 'large-scale' is assessed by reference to the number of data subjects, the volume of data, the duration of processing and the geographical extent.

The DPO must have expert knowledge of data protection law and practice. The DPO can be an employee or an external service provider. The DPO must be involved in all matters relating to personal data protection, must be provided with the resources necessary to carry out their tasks, and must not receive instructions regarding the exercise of their tasks. The DPO reports directly to the highest management level of the controller or processor.

Under Article 38(3) GDPR, the DPO cannot be dismissed or penalised for performing their tasks. Dutch employment courts have addressed the interaction between this protection and Dutch employment law. A DPO who is also an employee enjoys both GDPR protection and the general dismissal protection under the Wet werk en zekerheid (Work and Security Act). Controllers who attempt to remove a DPO for raising compliance concerns face dual exposure.

The Records of Processing Activities (RoPA) required by Article 30 GDPR is the foundation of any compliance programme. The RoPA must document, for each processing activity: the name and contact details of the controller; the purposes of processing; a description of the categories of data subjects and personal data; the categories of recipients; transfers to third countries and the transfer mechanism; retention periods; and a general description of technical and organisational security measures. The RoPA must be made available to the AP on request.

Building a compliance programme in the Netherlands involves several interconnected workstreams: mapping data flows and completing the RoPA; assessing lawful bases and documenting the analysis; reviewing and updating privacy notices; implementing data subject rights procedures with defined response timelines; conducting Data Protection Impact Assessments (DPIAs) for high-risk processing under Article 35 GDPR; establishing a breach response procedure; auditing third-party processors and updating data processing agreements; and reviewing cross-border transfer mechanisms.

The AP maintains a list of processing activities for which a DPIA is mandatory in the Netherlands. This list, published under Article 35(4) GDPR, includes systematic and extensive profiling with significant effects, large-scale processing of special categories of data, systematic monitoring of publicly accessible areas, and processing of data of vulnerable individuals including children. Controllers who commence high-risk processing without completing a DPIA face enforcement action regardless of whether harm has occurred.

Many underappreciate the cost of retrofitting compliance. Businesses that build data protection into their systems and processes from the outset - the 'privacy by design and by default' principle in Article 25 GDPR - spend significantly less on remediation than those who address compliance reactively. The AP has made privacy by design a stated enforcement priority, and its guidance on the subject is detailed and prescriptive.

We can help build a compliance strategy tailored to your operations in the Netherlands. Contact info@vlo.com to discuss your specific situation.

What are the most significant practical risks for a foreign company processing Dutch customer data without an EU establishment?

A foreign company processing personal data of individuals in the Netherlands is subject to the GDPR by virtue of Article 3(2), which applies the regulation to controllers and processors not established in the EU where they offer goods or services to, or monitor the behaviour of, individuals in the EU. Without an EU establishment, the company must appoint an EU representative under Article 27 GDPR. The AP can investigate and fine the company directly, and the absence of an EU representative is itself a violation subject to fines of up to EUR 10 million or 2% of global annual turnover. The representative does not absorb liability but serves as the AP's point of contact. Failure to appoint one signals to the AP that the company has not assessed its GDPR obligations, which typically triggers a broader investigation.

How long does an AP investigation typically take, and what are the financial consequences of a finding of non-compliance?

The duration of an AP investigation varies significantly depending on the complexity of the matter and whether the controller cooperates. Straightforward complaint-based investigations may conclude within six to twelve months. Complex investigations involving large organisations or systemic violations can extend over several years. Financial consequences include administrative fines under Article 83 GDPR, which are tiered: less serious violations attract fines up to EUR 10 million or 2% of global annual turnover; more serious violations attract fines up to EUR 20 million or 4% of global annual turnover. In addition to fines, the AP can issue orders requiring remediation within a specified period, with periodic penalty payments for non-compliance. Reputational damage and the cost of legal representation during the investigation add to the total cost.

When should a company choose SCCs over BCRs for intra-group data transfers, and what are the key differences?

SCCs are appropriate for most intra-group transfers, particularly where the group structure is relatively simple, the number of entities involved is limited, or the group needs a transfer mechanism in place quickly. SCCs can be implemented contractually without regulatory approval, though a TIA is required. BCRs are more appropriate for large, complex multinational groups with stable structures and significant ongoing intra-group data flows, because BCRs, once approved, provide a comprehensive and flexible framework that does not require individual contracts for each transfer relationship. The approval process for BCRs is lengthy and resource-intensive. A group that is growing rapidly or restructuring frequently may find that BCRs become outdated before approval is granted, making SCCs the more practical choice during periods of change.

Data protection compliance in the Netherlands requires a structured, documented and continuously maintained programme. The GDPR and UAVG together create a demanding legal environment, and the AP enforces it actively. The cost of proactive compliance is manageable; the cost of reactive remediation - fines, legal fees, reputational damage and operational disruption - is substantially higher. International businesses operating in the Dutch market should treat data protection as a core legal and operational priority, not a checkbox exercise.

Our law firm Vetrov & Partners has experience supporting clients in the Netherlands on data protection and privacy matters. We can assist with GDPR compliance assessments, DPO advisory services, data breach response, cross-border transfer structuring and AP investigation defence. To receive a consultation, contact: info@vlo.com.

To receive a checklist for building a full data protection compliance programme in the Netherlands, send a request to info@vlo.com.