Netherlands: Controller/Processor Duties

Accountability And DpiaGreen

The AP has published a binding national list of processing operations requiring a DPIA, including large-scale/systematic employee monitoring, covert camera surveillance for fraud prevention, and large-scale biometric identification.

Claims (1):

• The AP's published DPIA list requires a mandatory data protection impact assessment for, among other things, large-scale and/or systematic monitoring of employee activity, covert camera surveillance for theft/fraud prevention, and large-scale processing for unique identification.

Dpo RequirementsGreen

DPO appointment follows GDPR Article 37 thresholds (public authorities, large-scale monitoring, large-scale special-category processing); DPO positioning was the subject of a 2023 EDPB coordinated enforcement action in which the AP participated.

Claims (1):

• The EDPB's 2023 Coordinated Enforcement Framework action, in which the AP participates as an EEA supervisory authority, focused specifically on the designation and positioning of Data Protection Officers.

Ropa RequirementsGreen

Controllers and processors must maintain records of processing activities under GDPR Article 30; no NL-specific derogation identified for the general regime (a separate, distinct ROPA duty exists under the Law Enforcement Directive regime for police data, outside this baseline's GDPR scope).

Joint Controller ArrangementsGreen

Joint-controller arrangements follow GDPR Article 26 directly; no NL-specific overlay identified.

Absence provenance: unavailable. Searched: UAVG joint controller provisions, AP guidance joint controllers.

Security MeasuresAmber

Security-of-processing obligations under GDPR Article 32 are actively enforced; the AP fined an employer for maintaining an internet-accessible sick-leave register without multi-factor authentication.

Claims (1):

• The AP fined employer CP&A for security failings after its online sick-leave register, containing health data, was accessible without multi-factor authentication, finding that internet-accessible sick-leave systems require MFA beyond a regular login.

Breach NotificationGreen

Breach notification duties follow GDPR Articles 33-34: notify the AP within 72 hours of becoming aware unless unlikely to result in risk, and notify affected individuals without undue delay where high risk is likely.

Claims (1):

• Under GDPR Article 33, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Retention And DisposalAmber

Retention limitation follows the GDPR storage-limitation principle (Article 5(1)(e)); no NL-specific statutory retention schedule identified at the omnibus level beyond sectoral rules.

Absence provenance: unavailable. Searched: UAVG retention schedule, AP retention guidance.