---
title: "Netherlands — Controller/Processor Duties | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/netherlands/controller-processor-duties/
source_html: /jurisdictions/netherlands/controller-processor-duties/index.html
description: "Netherlands — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 4 claims Green ▾ # Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and a"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 3fe9d0880de98cc82b44a4f49d988ba9484a0f52c924c58445694f9ff904ddad
generator: "fe-fleet/md-twin@1.0"
---
# Netherlands — Controller/Processor Duties | Data Protection Monitor

### D4Controller/Processor Duties7 sub-modules4 claimsGreen▾#

Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling.

Primary framework GDPR Articles 24-39, UAVG, Works Councils Act (WOR) Article 27

Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/)

Traffic-light rationale — Green Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling.

#### Sub-modules (7)

#### Accountability And DpiaGreen

The AP has published a binding national list of processing operations requiring a DPIA, including large-scale/systematic employee monitoring, covert camera surveillance for fraud prevention, and large-scale biometric identification.

Claims (1):

- The AP's published DPIA list requires a mandatory data protection impact assessment for, among other things, large-scale and/or systematic monitoring of employee activity, covert camera surveillance for theft/fraud prevention, and large-scale processing for unique identification.

#### Dpo RequirementsGreen

DPO appointment follows GDPR Article 37 thresholds (public authorities, large-scale monitoring, large-scale special-category processing); DPO positioning was the subject of a 2023 EDPB coordinated enforcement action in which the AP participated.

Claims (1):

- The EDPB's 2023 Coordinated Enforcement Framework action, in which the AP participates as an EEA supervisory authority, focused specifically on the designation and positioning of Data Protection Officers.

#### Ropa RequirementsGreen

Controllers and processors must maintain records of processing activities under GDPR Article 30; no NL-specific derogation identified for the general regime (a separate, distinct ROPA duty exists under the Law Enforcement Directive regime for police data, outside this baseline's GDPR scope).

#### Joint Controller ArrangementsGreen

Joint-controller arrangements follow GDPR Article 26 directly; no NL-specific overlay identified.

Absence provenance: unavailable . Searched: UAVG joint controller provisions, AP guidance joint controllers.

#### Security MeasuresAmber

Security-of-processing obligations under GDPR Article 32 are actively enforced; the AP fined an employer for maintaining an internet-accessible sick-leave register without multi-factor authentication.

Claims (1):

- The AP fined employer CP&A for security failings after its online sick-leave register, containing health data, was accessible without multi-factor authentication, finding that internet-accessible sick-leave systems require MFA beyond a regular login.

#### Breach NotificationGreen

Breach notification duties follow GDPR Articles 33-34: notify the AP within 72 hours of becoming aware unless unlikely to result in risk, and notify affected individuals without undue delay where high risk is likely.

Claims (1):

- Under GDPR Article 33, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

#### Retention And DisposalAmber

Retention limitation follows the GDPR storage-limitation principle (Article 5(1)(e)); no NL-specific statutory retention schedule identified at the omnibus level beyond sectoral rules.

Absence provenance: unavailable . Searched: UAVG retention schedule, AP retention guidance.

Category narrative 75 words

Controllers and processors are subject to the full GDPR accountability toolkit. The AP has published a binding national DPIA 'blacklist' identifying processing types requiring a mandatory DPIA (large-scale employee monitoring, covert camera surveillance, large-scale biometric identification). Breach notification follows GDPR Articles 33-34 (72-hour regulator notification; subject notification where high risk). AP enforcement demonstrates active supervision of security-of-processing duties for sensitive employee health data, and Dutch Works Councils hold a statutory co-determination right over personnel-monitoring systems.

Evidence 4

Sources and claims (4)
- Confirmed[AP/EDPB](https://www.edpb.europa.eu/sites/default/files/decisions/nl_2020-09-02_-_dpia_list_nl_sa_-_national_decision_en.pdf) — The AP's published DPIA list requires a mandatory data protection impact assessment for, among other things, large-scale and/or systematic monitoring of employee activity, covert camera surveillance for theft/fraud prevention, and large-scale processing for unique identification.observed 2026-08-03
- Confirmed[IAPP](https://iapp.org/news/a/dutch-dpa-publishes-gdpr-fining-structure/) — The EDPB's 2023 Coordinated Enforcement Framework action, in which the AP participates as an EEA supervisory authority, focused specifically on the designation and positioning of Data Protection Officers.observed 2026-08-03
- Confirmed[AP/EDPB](https://www.edpb.europa.eu/news/national-news/2021/dutch-dpa-cpa-receives-fine-violating-privacy-sick-employees-0_en) — The AP fined employer CP&A for security failings after its online sick-leave register, containing health data, was accessible without multi-factor authentication, finding that internet-accessible sick-leave systems require MFA beyond a regular login.observed 2026-08-03
- Confirmed[EDPB](https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_guidelines_202209_personal_data_breach_notification_v2.0_nl.pdf) — Under GDPR Article 33, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.observed 2026-08-03