#
Directly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices.
Sub-modules (5)
Access RightGreen
Access rights follow GDPR Article 15; AP enforcement confirms controllers may not impose disproportionate identity-verification barriers (e.g., mandatory ID-copy uploads) on access/erasure requests.
Claims (1):
- The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data.
Rectification And ErasureGreen
Controllers must notify recipients of any rectification, erasure, or restriction under Article 19 GDPR unless impossible or disproportionate.
Claims (1):
- Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request.
Restriction And ObjectionGreen
Restriction and objection rights follow GDPR Articles 18 and 21 directly with no NL-specific derogation identified.
Data PortabilityGreen
Portability follows GDPR Article 20, applying where processing is based on consent or contract and carried out by automated means.
Claims (1):
- Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible.
Deadlines And Response WindowsGreen
Controllers must respond to data subject requests without undue delay and within one month, extendable by two further months for complex/numerous requests, per GDPR Article 12(3).
Claims (1):
- GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands.
Data Subject Rights
A proposal to amend the UAVG is reported to be in consultation as of 2026, which would extend independent data-subject-request capacity to children aged 12 and above, and would narrow the definition of criminal personal data under Dutch law. This proposal has not been enacted, and its current legislative stage and expected effective date are not established to a primary source this cycle; reports suggest it remains at consultation stage without a confirmed timeline for enactment.
If enacted, this amendment would mark a structural change to who may exercise data-subject rights independently under Dutch law, lowering the effective age threshold for autonomous exercise of access, rectification, and erasure rights below the general default position that typically requires parental involvement for younger data subjects. The narrowing of the criminal-personal-data definition referenced in the same proposal is a related but distinct change affecting the special-category processing rules applicable to criminal-record information.
Outlook
The UAVG amendment's progression from consultation toward a confirmed legislative timetable is the clearest item to watch for the data-subject-rights dimension of the Dutch framework. Until a primary legislative source confirms the stage and expected effective date, this remains a reported but unconfirmed development.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (4)
- ConfirmedAP/EDPB — The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data.observed
- ConfirmedEUR-Lex — Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request.observed
- ConfirmedEUR-Lex — Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible.observed
- ConfirmedEUR-Lex — GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands.observed