---
title: "Netherlands — Enforcement & Redress | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/netherlands/enforcement-and-redress/
source_html: /jurisdictions/netherlands/enforcement-and-redress/index.html
description: "Netherlands — Enforcement & Redress: enforcement_and_redress Enforcement & Redress 6 sub-modules 8 claims Green ▾ # Mature, actively used enforcement toolkit with a published fining structure and recent illustrative d"
generated_at: 2026-10-25T04:46:50Z
content_sha256: ec3a04840afb43a929e73f75e0d6ea63c558f08d901e257a14812b1cfe5f02c1
generator: "fe-fleet/md-twin@1.0"
---
# Netherlands — Enforcement & Redress | Data Protection Monitor

### D10Enforcement & Redress6 sub-modules8 claimsGreen▾#

Mature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option.

Primary framework GDPR Articles 58, 77-84; UAVG

Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/)

Traffic-light rationale — Green Mature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option.

#### Sub-modules (6)

#### Regulator Powers And PenaltiesGreen

The AP published a four-category fining structure with monetary ranges from €0 up to €1,000,000 per infringement category, escalating for category-four offences deemed inadequate.

Claims (1):

- The AP created a four-tiered penalty structure for GDPR infringements ranging from €0-200,000 (category one) up to €450,000-1,000,000 (category four), with higher fines available where a category-four penalty is deemed inappropriate.

#### Enforcement Activity IndexGreen

Illustrative recent enforcement includes the €525,000 DPG Media Magazines fine and the CP&A employee-health-data security fine.

Claims (2):

- The AP imposed a €525,000 fine on DPG Media Magazines B.V. for infringing GDPR Article 12(2) by unnecessarily requiring copies of identity documents from individuals exercising access and erasure rights.
- The AP fined employer CP&A for GDPR violations relating to insecure online processing of employees' sick-leave (health) data lacking multi-factor authentication.

#### Regulator Funding And CapacityAmber

No specific NL AP budget/headcount figures were surfaced in this run; the AP operates as an independent non-departmental public body under UAVG Article 11 budgeting provisions.

Absence provenance: unavailable . Searched: Autoriteit Persoonsgegevens jaarverslag 2025 budget capacity.

Claims (1):

- UAVG Article 11 requires the AP, as an independent non-departmental public body, to draw up its own draft budget subject to the Dutch non-departmental public bodies framework act.

#### Collective Redress And Class ActionsAmber

The Netherlands declined to adopt the GDPR Article 80(2) opt-out mechanism, instead requiring all affected data subjects to individually opt in for their data to be submitted as evidence in a collective action.

Claims (1):

- The Dutch GDPR Implementation Bill specifically prohibits collective actions proceeding against a data subject's will, requiring all data subjects whose data forms part of a contested processing operation to individually sign up for a collective action, meaning the Netherlands did not adopt the Article 80(2) GDPR opt-out mechanism.

#### Private Right Of ActionGreen

Data subjects retain the GDPR Article 78/79 right to an effective judicial remedy against both supervisory-authority decisions and controllers/processors directly before Dutch courts.

Claims (1):

- The CJEU's judgment in Case C-245/20 (Autoriteit Persoonsgegevens), arising from a Dutch court reference, addressed the scope of AP supervisory competence under Article 55(3) GDPR over data processing by courts acting in their judicial capacity.

#### Recent Developments 180DGreen

Within the relevant window, the CJEU's Grand Chamber ruling of 10 February 2026 in WhatsApp Ireland v EDPB (C-97/23 P) addressed judicial review of EDPB binding Article 65 decisions arising from one-stop-shop disputes, relevant to Dutch controllers subject to lead-authority decisions; the EDPB also adopted a statement on DPAs' role in the AI Act framework (17 July 2026).

Claims (2):

- The CJEU Grand Chamber issued its ruling of 10 February 2026 in WhatsApp Ireland Ltd v European Data Protection Board (Case C-97/23 P), concerning the reviewability under Article 263 TFEU of binding EDPB Article 65 dispute-resolution decisions arising from the one-stop-shop mechanism used against the Irish lead authority's draft WhatsApp decision.
- The EDPB, of which the AP is a member, adopted a statement on 17 July 2026 concerning data protection authorities' role in the EU AI Act framework, relevant to AP's interaction with AI Act competent authorities in the Netherlands.

Category narrative 125 words

The AP exercises the full GDPR Article 58 investigative and corrective toolkit and has published a four-tier fining structure ranging up to €1,000,000 per category (with higher fines possible where deemed appropriate). Enforcement examples include the €525,000 DPG Media Magazines fine (Article 12(2) transparency) and the CP&A fine for insecure health-data processing. NL notably declined to adopt the GDPR Article 80(2) opt-out collective-action mechanism, requiring data subjects to individually opt in to collective privacy actions. The CJEU's 2022 ruling in Case C-245/20 clarified limits on AP jurisdiction over courts acting in their judicial capacity, and the Court's 2026 WhatsApp v EDPB ruling (C-97/23 P) addressed challengeability of EDPB binding decisions within the one-stop-shop mechanism, both bearing on Dutch enforcement practice as an EU Member State.

Periodic update · new data 2026-10-11

#### Enforcement & Redress

The Autoriteit Persoonsgegevens imposed a fine of EUR824,990,000 on Uber on 21 August 2026 for breaching Article 22 of the GDPR through automated, insufficiently human-reviewed driver-account deactivations between 2018 and 2022, combined with inadequate information provided to affected drivers. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU to date, exceeded only by Meta's EUR1.2 billion penalty. Uber has publicly announced its intention to appeal.

This record-scale sanction arrives alongside a structural change to how AP enforcement outcomes reach the public. Article 21b of the Uitvoeringswet AVG, introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026, makes publication the default position for AP enforcement decisions, including orders, fines and settlements, publishable no earlier than two weeks after the decision absent an exception. Taken together, the Uber fine and the new publication default mean that both the scale and the visibility of AP enforcement action have increased within the same period, raising the practical consequence of any future AP sanction for a regulated entity.

#### Outlook

The Uber appeal is the primary near-term item to watch, both for its outcome and for what it may reveal about the durability of the AP's Article 22 automated-decision-making theory. The first enforcement decisions published under the new article 21b default-publication regime, expected from mid-September 2026 onward, will be the first real test of how the transparency reform operates in practice.

1 earlier distinct update(s) Periodic update · new data 2026-09-28

#### Enforcement & Redress

The Netherlands' enforcement and redress landscape shifted materially this cycle through two nine-figure AP fines and a new statutory transparency obligation. The AP fined MLU B.V. (Yango) EUR100 million on 8 May 2026 for unlawful cross-border data transfers to Russia, and is reported to have fined Uber EUR824,990,000 on 21 August 2026 for unlawful automated decision-making, together representing a marked escalation in enforcement intensity by the Dutch regulator. The AP's standing statutory fine ceiling remains EUR20 million or 4% of global annual turnover, whichever is higher; both fines this cycle were calculated with reference to parent-company turnover consistent with EDPB fine-calculation guidance, explaining how figures well above the nominal EUR20 million ceiling were reached.

Separately, from 1 September 2026, a new Article 21b under the Verzamelwet gegevensbescherming obliges the AP to publish, by name, any sanction it imposes. This converts what had previously been discretionary publication practice into a statutory duty, meaning the AP's enforcement record will become systematically more visible and consistently published going forward, rather than subject to case-by-case publication decisions.

#### Outlook

The combination of two nine-figure fines and a new mandatory publication duty marks the Netherlands as an increasingly assertive enforcement jurisdiction within the GDPR framework. Whether the Yango and Uber fines are appealed, and how the new Article 21b publication duty is applied in practice from 1 September 2026 onward, are the clearest markers to track for this module going forward.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Evidence 8

Sources and claims (8)
- Confirmed[IAPP](https://iapp.org/news/a/dutch-dpa-publishes-gdpr-fining-structure/) — The AP created a four-tiered penalty structure for GDPR infringements ranging from €0-200,000 (category one) up to €450,000-1,000,000 (category four), with higher fines available where a category-four penalty is deemed inappropriate.observed 2026-08-03
- Confirmed[AP/EDPB](https://www.edpb.europa.eu/news/national-news/2022/dutch-sa-fines-dpg-media-magazines-unnecessarily-requesting-copies-identity_en) — The AP imposed a €525,000 fine on DPG Media Magazines B.V. for infringing GDPR Article 12(2) by unnecessarily requiring copies of identity documents from individuals exercising access and erasure rights.observed 2026-08-03
- Confirmed[AP/EDPB](https://www.edpb.europa.eu/news/national-news/2021/dutch-dpa-cpa-receives-fine-violating-privacy-sick-employees-0_en) — The AP fined employer CP&A for GDPR violations relating to insecure online processing of employees' sick-leave (health) data lacking multi-factor authentication.observed 2026-08-03
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/dutch_general_general_data_protection_regulation_implemention_act.pdf) — UAVG Article 11 requires the AP, as an independent non-departmental public body, to draw up its own draft budget subject to the Dutch non-departmental public bodies framework act.observed 2026-08-03
- Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The Dutch GDPR Implementation Bill specifically prohibits collective actions proceeding against a data subject's will, requiring all data subjects whose data forms part of a contested processing operation to individually sign up for a collective action, meaning the Netherlands did not adopt the Article 80(2) GDPR opt-out mechanism.observed 2026-08-03
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62020CC0245) — The CJEU's judgment in Case C-245/20 (Autoriteit Persoonsgegevens), arising from a Dutch court reference, addressed the scope of AP supervisory competence under Article 55(3) GDPR over data processing by courts acting in their judicial capacity.observed 2026-08-03
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/?uri=CELEX:62023CJ0097) — The CJEU Grand Chamber issued its ruling of 10 February 2026 in WhatsApp Ireland Ltd v European Data Protection Board (Case C-97/23 P), concerning the reviewability under Article 263 TFEU of binding EDPB Article 65 dispute-resolution decisions arising from the one-stop-shop mechanism used against the Irish lead authority's draft WhatsApp decision.observed 2026-08-03
- Confirmed[EDPB](https://www.edpb.europa.eu/news/edpb-adopts-statement-on-dpas-role-in-ai-act-framework-eu-us-data-privacy-framework-faq-and_en) — The EDPB, of which the AP is a member, adopted a statement on 17 July 2026 concerning data protection authorities' role in the EU AI Act framework, relevant to AP's interaction with AI Act competent authorities in the Netherlands.observed 2026-08-03