---
title: "Netherlands — Cross-Border & Adequacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/netherlands/cross-border-and-adequacy/
source_html: /jurisdictions/netherlands/cross-border-and-adequacy/index.html
description: "Netherlands — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 3 claims Green ▾ # Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate i"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 8b2e1ed1e0f55a2e22c90a1a2c7bb31d4923fd54c0cd0aaf0fde8a09d1f55453
generator: "fe-fleet/md-twin@1.0"
---
# Netherlands — Cross-Border & Adequacy | Data Protection Monitor

### D5Cross-Border & Adequacy6 sub-modules3 claimsGreen▾#

Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified.

Primary framework GDPR Articles 44-49

Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/)

Traffic-light rationale — Green Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified.

#### Sub-modules (6)

#### Transfer MechanismsGreen

Transfers rely on Commission adequacy decisions, SCCs, BCRs, or Article 49 derogations, applying directly under GDPR Chapter V.

Claims (1):

- Cross-border transfers of personal data from the Netherlands to third countries rely on the GDPR Chapter V toolkit: European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or Article 49 derogations.

#### Adequacy ReceivedGreen

As an EU Member State, NL does not receive bilateral adequacy from third countries; it operates within the EU's mutual-recognition (GDPR-internal) framework rather than a receiving-adequacy structure.

Absence provenance: unavailable . Searched: Netherlands adequacy received from third country.

#### Adequacy GrantedGreen

Adequacy decisions granted to third countries (e.g., the UK) are adopted at EU level by the European Commission and apply automatically in NL; the UK adequacy decisions are currently under an EDPB-reviewed extension process.

Claims (1):

- The EDPB adopted opinions on the European Commission's draft decisions extending the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive, an EU-wide determination that applies automatically in the Netherlands as an EU Member State.

#### Sccs And BcrsAmber

BCR authorisation in NL transitioned from a Ministry of Justice permit system to AP approval under GDPR; legacy permits faced a risk of lapse absent timely AP authorisation.

Claims (1):

- Binding Corporate Rules previously authorised under a Ministry of Justice and Security permit faced a risk of becoming null and void from 25 May 2018 unless the AP issued its own GDPR-era authorisation, as the GDPR Implementation Bill did not expressly address transitional treatment.

#### Transfer Impact AssessmentAmber

TIA obligations follow the EDPB's general post-Schrems II recommendations, applied by the AP as an EEA authority; no NL-specific TIA methodology beyond EDPB guidance was identified.

Absence provenance: unavailable . Searched: AP transfer impact assessment guidance Netherlands.

#### Data LocalisationRed

No general data-localisation mandate exists in the Dutch omnibus DP regime.

Absence provenance: unavailable . Searched: Netherlands data localisation requirement GDPR, UAVG data localisation.

Category narrative 63 words

As an EU Member State, NL's cross-border transfer regime is governed directly by GDPR Chapter V: adequacy decisions issued by the European Commission apply uniformly across the EU including NL (e.g., ongoing extension of UK adequacy), alongside SCCs, BCRs and Article 49 derogations. The pre-GDPR Ministerial BCR-permit system was replaced by AP authorisation. No general data-localisation mandate exists in the Dutch omnibus regime.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Evidence 3

Sources and claims (3)
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:32016R0679) — Cross-border transfers of personal data from the Netherlands to third countries rely on the GDPR Chapter V toolkit: European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or Article 49 derogations.observed 2026-08-03
- Probable[EDPB](https://www.edpb.europa.eu/news/draft-uk-adequacy-decisions-edpb-adopts-opinions_en) — The EDPB adopted opinions on the European Commission's draft decisions extending the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive, an EU-wide determination that applies automatically in the Netherlands as an EU Member State.observed 2026-08-03
- Probable[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — Binding Corporate Rules previously authorised under a Ministry of Justice and Security permit faced a risk of becoming null and void from 25 May 2018 unless the AP issued its own GDPR-era authorisation, as the GDPR Implementation Bill did not expressly address transitional treatment.observed 2026-08-03