--- title: "Netherlands Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/netherlands/ source_html: /jurisdictions/netherlands/index.html description: "Netherlands data protection and privacy regulation: 10 categories, 126 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 9607408e4be8835277dfc4fe04ffb74a9f401d3c045d65ffa2f0cce50dc74146 generator: "fe-fleet/md-twin@1.0" --- # Netherlands Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/netherlands/), [World Payments](https://payments.gi/jurisdictions/netherlands/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 126 claims · 111 sources in the cumulative register Download report (PDF) Expand all The Autoriteit Persoonsgegevens (AP) published a vision document on generative artificial intelligence on 4 February 2026, naming artificial intelligence as a top enforcement priority for 2026 and beyond. Data collected 2026-11-04 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups (5 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=NETHERLANDS)[Build Report](/reports/?j=NETHERLANDS)[Compare](/compare/?j=NETHERLANDS) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Autoriteit Persoonsgegevens (AP) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2027 CJEU appeal in EU-US DPF adequacy challenge (C-703/25 P) Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 126 Claims 15 Tier-1 sources Traffic-light mix 7 green 3 amber (sums to 10 rendered categories; click to filter) No red categories; 6 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Netherlands is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Netherlands’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,111 Full executive summary 314 ###### Latest update · 4 November 2026 #### Lead Signal The Dutch Autoriteit Persoonsgegevens combined its largest-ever sanction with a structural transparency reform, materially raising the stakes of GDPR non-compliance in the Netherlands. The AP fined Uber EUR824,990,000 on 21 August 2026 for breaching Article 22 GDPR's prohibition on solely-automated decisions with significant effect, arising from automated driver-account deactivations between 2018 and 2022 conducted without meaningful human review, compounded by inadequate information given to affected drivers. The fine is the AP's fourth against Uber and the second-largest GDPR fine issued anywhere in the EU, after Meta's EUR1.2 billion penalty; Uber has announced it will appeal. The size and basis of the fine signal that automated decision-making without a genuine human-review layer remains a top-tier enforcement target for the AP, even where the underlying processing long preceded the enforcement action. Alongside this, a new procedural rule under Article 21b of the Uitvoeringswet AVG, introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026, establishes publication as the default position for AP enforcement decisions, including orders, fines and settlements, which must now be published no earlier than two weeks after the decision absent an exception applying. Together, the record fine and the new default-publication rule mean that both the financial and reputational consequences of an AP enforcement decision have increased in the same period. #### Other Developments Three further strands moved. First, the Dutch government's draft Uitvoeringswet AI-verordening, published for consultation on 20 April 2026 and closed for comment on 1 June 2026, proposes designating the AP and the RDI as joint coordinators of a decentralised, sector-based market-surveillance model for the AI Act, with anticipated entry into force on 2 August 2027; the Netherlands had missed the EU's August 2025 deadline for authority designation, so this draft represents a belated catch-up rather than an early mover position. Second, as of 1 July 2026, the Telecommunicatiewet no longer permits businesses to call consumers for telemarketing purposes without consent, even where the consumer is or has been an existing customer, closing the telephone-channel soft opt-in that previously applied to existing customers; the amendment leaves the separate email and SMS existing-customer soft opt-in under article 11.7(4) untouched, and excludes charities, charity lotteries, and periodical publishers from the tightened rule. Third, the Dutch Data Act implementing act, in effect since 21 November 2025, authorised the Autoriteit Consument en Markt to enforce Regulation (EU) 2023/2854 against cloud providers and smart-device manufacturers headquartered in the Netherlands, covering data-sharing and access requests as well as cloud-switching and interoperability barriers; EU-wide, switching penalties are already prohibited and migration charges reduced to the minimum necessary from 12 January 2026, with a full ban on switching charges following from 12 January 2027. #### Cross-Monitor Connections The draft Uitvoeringswet AI-verordening and the Uber Article 22 fine both bear on the artificial-intelligence monitor's coverage of automated decision-making and AI Act market-surveillance governance in the Netherlands; that dimension is tracked in full there and is noted here only as it intersects with the AP's data-protection enforcement role. The Data Act implementing act and ACM's new enforcement authority touch on cloud-switching and data-portability obligations that may be relevant to the crypto monitor's data-infrastructure coverage where crypto-asset service providers rely on cloud-hosted infrastructure, though no NL crypto-specific crossover was identified. No world-payments- or advennt-relevant crossover was identified in the data-protection findings. #### Outlook The principal items to watch are whether Uber's announced appeal of the EUR824,990,000 fine proceeds and on what grounds, and whether the first enforcement decisions published under the new Article 21b default-publication regime begin to appear from mid-September 2026 onward, which will show how the transparency reform operates in practice. On the AI Act side, whether the draft Uitvoeringswet AI-verordening progresses from consultation toward introduction before the Tweede Kamer ahead of its anticipated 2 August 2027 entry into force remains unverified and is a key marker for the decentralised supervisory model taking shape. The Data Act's further tightening toward a full ban on cloud-switching charges from 12 January 2027 is a firm, dated milestone for cloud and smart-device providers headquartered in the Netherlands. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Autoriteit Persoonsgegevens (AP) published a vision document on generative artificial intelligence on 4 February 2026, naming artificial intelligence as a top enforcement priority for 2026 and beyond. Read alongside the AP's broader 2026 annual plan, which also names mass surveillance, including online tracking, as one of three central 2026-2028 supervisory themes, this cycle marks a structural pivot in Dutch data-protection supervision toward algorithmic and surveillance oversight. This pivot sits alongside, rather than replaces, the AP's continuing adtech, children's-rights and general enforcement activity addressed below. #### Other Developments AdTech and cookie compliance move up the enforcement agenda. The AP's 2026 annual plan names transparency obligations under GDPR Articles 12 to 14, pre-consent tracking and cookie compliance as a top-three enforcement pillar for 2026, and the AP is understood to have opened active investigations in the telecom sector into contractual data steering and unauthorised processing. No fines or findings from those investigations have yet been reported. A children's-rights amendment is in consultation. A proposed amendment to the UAVG, the Dutch GDPR implementation act, would allow children aged 12 and above to make independent data-subject requests and would narrow the definition of criminal personal data. This remains at consultation stage and has not been enacted. Enforcement activity beyond the telecom investigations. The AP reports having completed multiple investigations resulting in warnings issued to municipal and public-institution websites, evidencing an active enforcement posture that extends beyond the headline AI and surveillance themes into routine public-sector compliance. #### Cross-Monitor Connections The AP's generative-AI vision document, and its naming of mass surveillance as a central 2026-2028 supervisory theme, both speak to territory that the artificial-intelligence monitor also tracks for the Netherlands; readers following that monitor's coverage of Dutch AI governance should read it alongside this cycle's data-protection developments, since both trace to the same AP institutional pivot toward AI and surveillance oversight. No crypto, financial-integrity or world-payments cross-reference arises from this cycle's Dutch data-protection developments. #### Outlook The AP's stated capacity constraints are likely to concentrate its broadened thematic scope, spanning AI, mass surveillance and adtech, on large-scale systems and organisations with significant societal impact, which may mean smaller-scale complaints are deprioritised even as the thematic net widens. The clearest markers to watch over the coming cycle are the progress of the UAVG amendment on minors' independent data-subject-request capacity through further stages of consultation, and any concrete enforcement action, rather than further vision documents, arising from the AP's generative-AI and mass-surveillance priorities. Read full brief · 1111 words ###### Latest update · 28 September 2026 #### Regulatory Status The Netherlands' data-protection enforcement posture escalated materially this cycle. The Autoriteit Persoonsgegevens fined MLU B.V. (Yango) EUR100 million on 8 May 2026 for unlawful cross-border personal-data transfers to Russia, and is reported to have fined Uber EUR824,990,000 on 21 August 2026 for unlawful automated decision-making in driver-account deactivations, together marking the second-largest GDPR fine on record. A new statutory duty under Article 21b of the Verzamelwet gegevensbescherming, effective 1 September 2026, now obliges the AP to publish, by name, any sanction it imposes. Separately, a proposed UAVG amendment in consultation as of 2026 would allow children aged 12 and above to make independent data-subject requests, though this remains unconfirmed to a primary legislative timeline. #### Outlook The progression of the UAVG children's-rights amendment toward enactment, and the practical operation of the new mandatory sanction-publication duty from 1 September 2026, are the clearest items to watch across the Dutch data-protection framework going forward. ###### Standing brief · as of 25 August 2026 #### Regulatory Status The Netherlands' data-protection enforcement posture is undergoing a structural pivot in 2026 toward algorithmic governance and mass surveillance, evidenced by the Autoriteit Persoonsgegevens' 4 February 2026 generative-AI vision document and its naming of mass surveillance, including online tracking, as a central 2026-2028 supervisory theme. This sits alongside a consultation-stage UAVG amendment that would lower the independent data-subject-request threshold for children to age 12 and narrow the criminal-personal-data definition, and alongside continuing adtech-sector enforcement, with active telecom-sector investigations into contractual data steering and unauthorised processing, plus completed investigations resulting in warnings to municipal and public-institution websites. #### Outlook The coming cycle's clearest markers are the UAVG amendment's progress through consultation, any concrete enforcement outcome from the open telecom-sector investigations, and any named-organisation enforcement action arising from the AP's generative-AI or mass-surveillance priorities. Read full brief · 314 words Key regulatory facts for Netherlands Regulatory Dimension Netherlands Standing Position Jurisdiction Netherlands (NL) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 126 sourced findings) Regulator & Framework Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations. Lawful Processing & Special Data Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations. Data Subject Rights Directly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices. Controller/Processor Duties Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling. Primary Instruments Cited EDPB, IAPP, DataGuidance, Multilaw, AVG Juristen Last Confirmed / Updated 2026-11-04 (111 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Netherlands: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations. #### Sub-modules (5) #### Regulator And AuthorityGreen The AP is the Article 51(1) GDPR supervisory authority, established under UAVG Chapter 2, headquartered in The Hague, currently chaired by Aleid Wolfsen. Claims (3): - The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR. - Autoriteit Persoonsgegevens (AP) — The Netherlands' independent national data protection supervisory authority under Article 51 GDPR. - Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) — AP is the national GDPR supervisory authority, designated under art. 51(1) GDPR via UAVG #### Act And InstrumentsGreen GDPR applies directly; UAVG supplements it in a policy-neutral manner, continuing pre-GDPR Dutch law insofar as permitted. Claims (8): - The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR. - Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty. - Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81. - Verzamelwet gegevensbescherming (UAVG amendment) — Amendments to UAVG (minors' rights, narrower criminal-data definition, stricter biometric conditions, mandatory publication of AP sanction decisions) commenced 2026-09-01 by royal decree of 2026-07-09, except one biometric-data provision (art. 29 UAVG) held back - Verzamelwet gegevensbescherming — Art. 21b UAVG establishes 'openbaar, tenzij' (public unless) as the default for AP enforcement decisions (orders, fines, settlements), to be published at the earliest two weeks after the decision. - UAVG (proposed amendment) — A proposal to amend the UAVG is in consultation as of 2026, including provisions to allow children aged 12 and above to make independent data-subject requests and to narrow the definition of criminal personal data. - GDPR + UAVG — Dutch data protection law rests on the directly-applicable GDPR and the national UAVG, both in force since 25 May 2018. - Verzamelwet gegevensbescherming — Art 41 UAVG tightened at consultation stage; AP raised compatibility doubt with Art 23 GDPR #### Material ScopeGreen UAVG Article 2 applies to processing wholly or partly by automated means and to non-automated processing forming part of a filing system, mirroring GDPR Article 2/4. Claims (1): - UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system. #### Territorial ScopeGreen The UAVG/GDPR regime extends to controllers/processors established in NL and to non-established controllers offering goods/services to, or monitoring the behaviour of, individuals in NL. Claims (1): - The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands. #### Regulator Registration And FilingAmber General notification duties were abolished under GDPR; a legacy Ministry-issued BCR permit regime was superseded by AP authorisation, with a risk of lapse absent timely AP action. Claims (2): - Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation. - Autoriteit Persoonsgegevens (AP) — Organisations to register a Data Protection Officer online with the AP, free of charge, whether the appointment is mandatory or voluntary. The Netherlands is an EU Member State operating under the GDPR as the omnibus instrument, implemented and supplemented domestically by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). The Autoriteit Persoonsgegevens (AP), seated in The Hague, is the designated national supervisory authority under Article 51(1) GDPR. Material and territorial scope follow the GDPR text as implemented policy-neutrally by the UAVG, including extraterritorial reach to non-established controllers targeting NL data subjects or monitoring behaviour occurring in NL. General notification/registration to the AP was abolished under GDPR in favour of accountability (ROPA, DPIA); a legacy BCR-permit regime under the Minister of Justice was replaced by AP authorisation. Periodic update · new data 2026-11-04 #### Regulator & Framework A new procedural reform has taken effect under article 21b of the Uitvoeringswet AVG (UAVG), introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026. The provision establishes an 'openbaar, tenzij' (public unless) default for Autoriteit Persoonsgegevens enforcement decisions, covering orders under penalty, cease-and-desist orders, administrative fines, and settlements. Under this default, such decisions are published no earlier than two weeks after the decision is made, absent an applicable exception. This is a procedural-transparency reform rather than a change to the AP's substantive powers: it alters when and how the outcome of an enforcement action becomes public, not what the AP may do. The reform materially changes the reputational consequence that follows an AP sanction, since publication is now the default position rather than a discretionary choice made case by case. The exact article number and full commencement scope of the Verzamelwet gegevensbescherming beyond article 21b UAVG specifically have not been independently verified at primary source. #### Outlook The item to watch is how the default-publication regime operates in practice: the first enforcement decisions published under article 21b from mid-September 2026 onward will show the real-world reputational effect of the reform, and whether any party successfully invokes an exception to delay or prevent publication. Sources and claims (15) - [EDPB](https://www.edpb.europa.eu/about-edpb/our-members_en) — The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR. - [IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR. - [DataGuidance](https://www.dataguidance.com/sites/default/files/dutch_general_general_data_protection_regulation_implemention_act.pdf) — UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system. - [IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands. - [IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation. - [Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_The_Netherlands.aspx) — Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty. - [Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_The_Netherlands.aspx) — Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81. - [AVG Juristen](https://avgjuristen.nl/de-uitvoeringswet-algemene-verordening-gegevensbescherming-wijzigt-per-1-september-2026-dit-verandert-er-deel-1/) — Verzamelwet gegevensbescherming (UAVG amendment) — Amendments to UAVG (minors' rights, narrower criminal-data definition, stricter biometric conditions, mandatory publication of AP sanction decisions) commenced 2026-09-01 by royal decree of 2026-07-09, except one biometric-data provision (art. 29 UAVG) held back - [Lexology](https://www.lexology.com/library/detail.aspx?g=2b2dcfb6-d6f7-4947-b073-3092bacbcb7f) — Verzamelwet gegevensbescherming — Art. 21b UAVG establishes 'openbaar, tenzij' (public unless) as the default for AP enforcement decisions (orders, fines, settlements), to be published at the earliest two weeks after the decision. - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/netherlands-data-privacy-laws/) — UAVG (proposed amendment) — A proposal to amend the UAVG is in consultation as of 2026, including provisions to allow children aged 12 and above to make independent data-subject requests and to narrow the definition of criminal personal data. - [Stibbe](https://www.stibbe.com/nl/publications-and-insights/de-transparante-toezichthouder-autoriteit-persoonsgegevens-past) — Autoriteit Persoonsgegevens (AP) — The Netherlands' independent national data protection supervisory authority under Article 51 GDPR. - [mijnevent.nl](https://mijnevent.nl/en/blog/dutch-privacy-fines-public-from-september) — GDPR + UAVG — Dutch data protection law rests on the directly-applicable GDPR and the national UAVG, both in force since 25 May 2018. - [Officiële Bekendmakingen](https://zoek.officielebekendmakingen.nl/kst-36264-19.html) — Autoriteit Persoonsgegevens (AP) — Organisations to register a Data Protection Officer online with the AP, free of charge, whether the appointment is mandatory or voluntary. - [Overheid.nl](https://wetten.overheid.nl/BWBR0040940/) — Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) — AP is the national GDPR supervisory authority, designated under art. 51(1) GDPR via UAVG - [InView / Onderneming en Recht](https://www.inview.nl/document/id0874c8f19540432b9596ea97eca5fbbc/gegevensbescherming-in-faillissement-onderneming-en-recht-nr-136-5-5-3-individuele-gevallen-beperken) — Verzamelwet gegevensbescherming — Art 41 UAVG tightened at consultation stage; AP raised compatibility doubt with Art 23 GDPR ### Netherlands: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations. Primary framework GDPR Articles 6, 7, 9 as supplemented by UAVG Chapter 3 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations. D2 · Lawful Processing — Full Module Record 4 sub-modules · 94 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Directly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices. Primary framework GDPR Articles 12-22 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Directly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices. #### Sub-modules (5) #### Access RightGreen Access rights follow GDPR Article 15; AP enforcement confirms controllers may not impose disproportionate identity-verification barriers (e.g., mandatory ID-copy uploads) on access/erasure requests. Claims (3): - The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data. - Autoriteit Persoonsgegevens (AP) — Data subjects in the Netherlands may exercise GDPR Chapter III rights via the controller, with AP enforcement backing. - UAVG Art 41(1) — Access right may be limited on a case-by-case basis to safeguard an Art 23(1) GDPR interest, including protection of the data subject or others' rights; no categorical restriction permitted #### Rectification And ErasureGreen Controllers must notify recipients of any rectification, erasure, or restriction under Article 19 GDPR unless impossible or disproportionate. Claims (1): - Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request. #### Restriction And ObjectionGreen Restriction and objection rights follow GDPR Articles 18 and 21 directly with no NL-specific derogation identified. #### Data PortabilityGreen Portability follows GDPR Article 20, applying where processing is based on consent or contract and carried out by automated means. Claims (1): - Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible. #### Deadlines And Response WindowsGreen Controllers must respond to data subject requests without undue delay and within one month, extendable by two further months for complex/numerous requests, per GDPR Article 12(3). Claims (3): - GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands. - Verzamelwet gegevensbescherming (UAVG Art 5 tiered minors regime) — Tiered regime for minors exercising Chapter III GDPR rights from 2026-09-01: under 12 only legal representative acts; 12-16 either data subject or representative; data subject alone may withdraw consent from age 12; guardians represent those under guardianship - GDPR Art 12(3)/Art 15 — Controller must respond to an access request within one month, extendable by two further months for complex/numerous requests Data subject rights in NL derive directly from GDPR Chapter III (access, rectification, erasure, restriction, objection, portability) with no material Dutch derogation. AP enforcement practice (e.g., the DPG Media Magazines fine) illustrates active supervision of the access/erasure request process, specifically prohibiting disproportionate identity-verification demands that obstruct rights exercise. Periodic update · new data 2026-09-28 #### Data Subject Rights A proposal to amend the UAVG is reported to be in consultation as of 2026, which would extend independent data-subject-request capacity to children aged 12 and above, and would narrow the definition of criminal personal data under Dutch law. This proposal has not been enacted, and its current legislative stage and expected effective date are not established to a primary source this cycle; reports suggest it remains at consultation stage without a confirmed timeline for enactment. If enacted, this amendment would mark a structural change to who may exercise data-subject rights independently under Dutch law, lowering the effective age threshold for autonomous exercise of access, rectification, and erasure rights below the general default position that typically requires parental involvement for younger data subjects. The narrowing of the criminal-personal-data definition referenced in the same proposal is a related but distinct change affecting the special-category processing rules applicable to criminal-record information. #### Outlook The UAVG amendment's progression from consultation toward a confirmed legislative timetable is the clearest item to watch for the data-subject-rights dimension of the Dutch framework. Until a primary legislative source confirms the stage and expected effective date, this remains a reported but unconfirmed development. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (9) - [AP/EDPB](https://www.edpb.europa.eu/news/national-news/2022/dutch-sa-fines-dpg-media-magazines-unnecessarily-requesting-copies-identity_en) — The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:32016R0679) — Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:32016R0679) — Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:32016R0679) — GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands. - [mijnevent.nl](https://mijnevent.nl/en/blog/dutch-privacy-fines-public-from-september) — Autoriteit Persoonsgegevens (AP) — Data subjects in the Netherlands may exercise GDPR Chapter III rights via the controller, with AP enforcement backing. - [Overheid.nl (Ministerie van Justitie en Veiligheid)](https://wetten.overheid.nl/BWBR0040940/2026-09-01/0) — UAVG Art 5(5) (as amended) — A minor data subject who has reached age 16 may bring proceedings for breach of GDPR rights without assistance of their legal representative - [AVG Juristen](https://avgjuristen.nl/de-uitvoeringswet-algemene-verordening-gegevensbescherming-wijzigt-per-1-september-2026-dit-verandert-er-deel-1/) — Verzamelwet gegevensbescherming (UAVG Art 5 tiered minors regime) — Tiered regime for minors exercising Chapter III GDPR rights from 2026-09-01: under 12 only legal representative acts; 12-16 either data subject or representative; data subject alone may withdraw consent from age 12; guardians represent those under guardianship - [Belastingdienst Kennisgroepen](https://kennisgroepen.belastingdienst.nl/publicaties/kg02420241-een-inzageverzoek-op-grond-van-artikel-15-avg-en-artikel-67-awr/) — GDPR Art 12(3)/Art 15 — Controller must respond to an access request within one month, extendable by two further months for complex/numerous requests - [Holla Advocaten](https://www.holla.nl/nieuws/inzage-in-het-advies-van-de-medisch-adviseur-een-belangenafweging) — UAVG Art 41(1) — Access right may be limited on a case-by-case basis to safeguard an Art 23(1) GDPR interest, including protection of the data subject or others' rights; no categorical restriction permitted ### Netherlands: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling. Primary framework GDPR Articles 24-39, UAVG, Works Councils Act (WOR) Article 27 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling. D4 · Controller & Processor — Full Module Record 7 sub-modules · 75 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified. Primary framework GDPR Articles 44-49 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 63 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Telecoms/ePrivacy and employment overlays are well documented; credit-scoring and education sub-modules lack NL-specific findings. Primary framework Telecommunicatiewet (transposing ePrivacy Directive 2002/58/EC); UAVG Chapter 3; Works Councils Act (WOR) Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Amber Telecoms/ePrivacy and employment overlays are well documented; credit-scoring and education sub-modules lack NL-specific findings. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 69 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie and direct-marketing rules are well documented; dark-pattern, opt-out-signal, clean-room and cross-context-advertising sub-modules lack NL-specific findings. Primary framework Telecommunicatiewet (ePrivacy transposition); GDPR Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Amber Cookie and direct-marketing rules are well documented; dark-pattern, opt-out-signal, clean-room and cross-context-advertising sub-modules lack NL-specific findings. Periodic update · new data 2026-11-04 #### AdTech & Commercial Privacy Since 1 July 2026, businesses may no longer call consumers for telemarketing purposes without consent under the amended Telecommunicatiewet, even where the consumer is, or has been, a customer of that business. This closes the telephone-channel soft opt-in that previously permitted calls to existing customers without separate consent. The amendment is limited in scope: it applies to telephone calls only and does not alter the separate existing-customer soft opt-in for email and SMS marketing preserved under article 11.7(4) of the Telecommunicatiewet. The amendment also carves out charities, lotteries that donate proceeds to charity, and periodical publishers from the tightened consent requirement. This is the one confirmed in-force change to the Dutch direct-marketing framework; no cookie-consent-specific or broader adtech development was independently re-verified in this window. #### Outlook Businesses that previously relied on the existing-customer telephone soft opt-in will need to have obtained affirmative consent before any telemarketing call made since 1 July 2026; the practical enforcement pattern around this change, including whether the Autoriteit Persoonsgegevens or another body brings early test cases, is the item to watch. Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy Since 1 July 2026, businesses may no longer call consumers for telemarketing purposes without consent under the amended Telecommunicatiewet, even where the consumer is, or has been, a customer of that business. This closes the telephone-channel soft opt-in that previously permitted calls to existing customers without separate consent. The amendment is limited in scope: it applies to telephone calls only and does not alter the separate existing-customer soft opt-in for email and SMS marketing preserved under article 11.7(4) of the Telecommunicatiewet. The amendment also carves out charities, lotteries that donate proceeds to charity, and periodical publishers from the tightened consent requirement. This is the one confirmed in-force change to the Dutch direct-marketing framework this cycle; no cookie-consent-specific or broader adtech development was independently re-verified in this window. #### Outlook Businesses that previously relied on the existing-customer telephone soft opt-in will need to have obtained affirmative consent before any telemarketing call made since 1 July 2026; the practical enforcement pattern around this change, including whether the Autoriteit Persoonsgegevens or another body brings early test cases, is the item to watch. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 64 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric and profiling rules are well established under GDPR/UAVG; AI Act competent-authority designation and NL-specific AI risk-assessment interplay is still maturing as of the 2 August 2026 application date. Primary framework GDPR Article 22; UAVG Article 29; EU AI Act (Regulation (EU) 2024/1689); Law Enforcement Directive (2016/680) Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Amber Biometric and profiling rules are well established under GDPR/UAVG; AI Act competent-authority designation and NL-specific AI risk-assessment interplay is still maturing as of the 2 August 2026 application date. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The Autoriteit Persoonsgegevens fined Uber EUR824,990,000 on 21 August 2026 for breaching Article 22 of the GDPR, which prohibits decisions based solely on automated processing that produce a significant effect on the data subject, absent a lawful basis and adequate safeguards. The breach arose from Uber's automated deactivation of driver accounts between 2018 and 2022 without what the AP found to be meaningful human review, compounded by inadequate information given to affected drivers about the basis for deactivation. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU, behind only Meta's EUR1.2 billion penalty. Uber has announced it will appeal the decision. Separately, and at an earlier stage of development, the Dutch government published a draft Uitvoeringswet AI-verordening (Uvai) for consultation on 20 April 2026, with the consultation period closing 1 June 2026. The draft designates the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur as joint coordinators of a decentralised, sector-based market-surveillance model for AI Act supervision in the Netherlands, with anticipated entry into force on 2 August 2027. The Netherlands had missed the EU's own August 2025 deadline for designating AI Act supervisory authorities, so this draft represents a belated structural response rather than an early-adopter position. #### Outlook Whether the Uber appeal proceeds, and on what grounds, will test the durability of the AP's Article 22 theory of automated decision-making without meaningful human review. Separately, whether the draft Uvai has progressed from the closed consultation toward formal introduction before the Tweede Kamer since 1 June 2026 has not been independently verified and remains open, as does the draft's anticipated 2 August 2027 entry-into-force date. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance The AP is reported to have fined Uber EUR824,990,000 on 21 August 2026 for operating automated systems that deactivated driver accounts without human review, a decision reported to breach the GDPR's Article 22 prohibition on solely automated decision-making that produces significant effects on individuals. This fine is described as the second-largest GDPR fine on record, reflecting the scale of exposure the AP is prepared to impose for automated-decision-making violations affecting a large population of gig-economy workers. The scale of this fine signals that the AP treats unlawful automated decision-making, specifically decisions taken without meaningful human review that carry significant consequences for affected individuals such as loss of livelihood through account deactivation, as among the most serious categories of GDPR violation it currently enforces. The AP has separately been reported to enforce EU AI Act prohibited-practices provisions since February 2025, indicating an emerging institutional focus on algorithmic-system oversight that extends beyond GDPR Article 22 into the newer AI-specific regulatory framework. #### Outlook Whether Uber challenges the AP's decision, and how any appeal addresses the automated-decision-making findings, is the clearest item to watch. More broadly, the AP's parallel enforcement role under both GDPR Article 22 and the AI Act's prohibited-practices provisions positions it as an increasingly significant algorithmic-governance enforcer, worth monitoring as its supervisory focus areas for 2026 become clearer. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 101 words · 17 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D9 Children & Vulnerable Groups5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status. Primary framework GDPR Article 8; UAVG Article 5 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups A proposed amendment to the UAVG, reported to be in consultation as of 2026, would allow children aged 12 and above to make independent data-subject requests under Dutch data protection law. This proposal is not yet enacted, and reports suggest it remains at consultation stage without a confirmed timeline for entry into force. If adopted, this would represent a structural shift in how Dutch law treats the data-protection agency of minors, granting a defined age cohort, 12 and above, the standing to exercise data-subject rights independently rather than through a parent or guardian. This is a notable departure from data-protection frameworks that set the age of independent digital consent higher, and its progress is worth tracking distinctly from the general data-subject-rights item given its specific focus on the vulnerable-groups dimension of Dutch law. #### Outlook The UAVG amendment's consultation status means no confirmed effective date exists yet for the children's independent-request provision. Its progression toward enactment is the key marker to watch for this module, alongside any further detail on how the narrowed criminal-personal-data definition referenced in the same proposal would apply to minors specifically. D9 · Children's Privacy — Full Module Record 5 sub-modules · 71 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Netherlands: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Mature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option. Primary framework GDPR Articles 58, 77-84; UAVG Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Mature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Autoriteit Persoonsgegevens imposed a fine of EUR824,990,000 on Uber on 21 August 2026 for breaching Article 22 of the GDPR through automated, insufficiently human-reviewed driver-account deactivations between 2018 and 2022, combined with inadequate information provided to affected drivers. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU to date, exceeded only by Meta's EUR1.2 billion penalty. Uber has publicly announced its intention to appeal. This record-scale sanction arrives alongside a structural change to how AP enforcement outcomes reach the public. Article 21b of the Uitvoeringswet AVG, introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026, makes publication the default position for AP enforcement decisions, including orders, fines and settlements, publishable no earlier than two weeks after the decision absent an exception. Taken together, the Uber fine and the new publication default mean that both the scale and the visibility of AP enforcement action have increased within the same period, raising the practical consequence of any future AP sanction for a regulated entity. #### Outlook The Uber appeal is the primary near-term item to watch, both for its outcome and for what it may reveal about the durability of the AP's Article 22 automated-decision-making theory. The first enforcement decisions published under the new article 21b default-publication regime, expected from mid-September 2026 onward, will be the first real test of how the transparency reform operates in practice. Periodic update · new data 2026-09-28 #### Enforcement & Redress The Netherlands' enforcement and redress landscape shifted materially this cycle through two nine-figure AP fines and a new statutory transparency obligation. The AP fined MLU B.V. (Yango) EUR100 million on 8 May 2026 for unlawful cross-border data transfers to Russia, and is reported to have fined Uber EUR824,990,000 on 21 August 2026 for unlawful automated decision-making, together representing a marked escalation in enforcement intensity by the Dutch regulator. The AP's standing statutory fine ceiling remains EUR20 million or 4% of global annual turnover, whichever is higher; both fines this cycle were calculated with reference to parent-company turnover consistent with EDPB fine-calculation guidance, explaining how figures well above the nominal EUR20 million ceiling were reached. Separately, from 1 September 2026, a new Article 21b under the Verzamelwet gegevensbescherming obliges the AP to publish, by name, any sanction it imposes. This converts what had previously been discretionary publication practice into a statutory duty, meaning the AP's enforcement record will become systematically more visible and consistently published going forward, rather than subject to case-by-case publication decisions. #### Outlook The combination of two nine-figure fines and a new mandatory publication duty marks the Netherlands as an increasingly assertive enforcement jurisdiction within the GDPR framework. Whether the Yango and Uber fines are appealed, and how the new Article 21b publication duty is applied in practice from 1 September 2026 onward, are the clearest markers to track for this module going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 125 words · 25 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (39 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties