Data Protection Monitor
Global Privacy & Data Protection Intelligence

Netherlands (NL) · Module Detail

Netherlands: Lawful Processing & Special Data

← Full Netherlands overview Build report with Netherlands Request deeper dive

#

Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.

Primary frameworkGDPR Articles 6, 7, 9 as supplemented by UAVG Chapter 3
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenCore lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.

Sub-modules (4)

Lawful BasesGreen

The six GDPR Article 6 lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) apply directly and exhaustively in NL.

Claims (1):

  • Data controllers in the Netherlands may only process personal data where one of the GDPR Article 6 lawful bases applies, including consent, contractual necessity, legal obligation, vital interests, public-interest task, or legitimate interests.

Special CategoriesAmber

UAVG Chapter 3 layers additional, sector-specific exceptions onto GDPR Article 9 for controllers such as hospitals, schools and insurers.

Claims (1):

  • UAVG Chapter 3 provides generic exceptions (e.g., explicit consent) alongside specific per-category exceptions allowing defined controllers such as hospitals, schools and insurance companies to process special categories of data for defined purposes (identification, sick-leave management, benefits, pre-employment screening, crime prevention).

Pseudonymisation And AnonymisationAmber

Biometric data processing is restricted under UAVG Article 29 to cases of strict necessity for authentication or security purposes, addressing a gap left by the GDPR's blanket Article 9 prohibition.

Claims (1):

  • UAVG Article 29 permits processing of biometric data for unique identification only where strictly necessary for authentication or security purposes, addressing a gap in GDPR Article 9 that otherwise lacked a workable workplace-biometrics exception.
Category narrative94 words

Lawful bases and consent standards follow GDPR Articles 6 and 7 directly. The Netherlands set the child consent age threshold for information-society-service consent at 16 (the GDPR default, not exercising the Member-State option to lower it to as little as 13). UAVG Chapter 3 supplies sector-specific exceptions permitting processing of special-category data (health, biometric, criminal) by defined controller categories (hospitals, schools, insurers) for defined purposes, and restricts biometric processing to strict necessity for authentication/security. A pending 'Data Protection Collective Act' bill would adjust several special-data and children's-consent provisions but is not yet in force.

Sources and claims (5)
  1. ConfirmedEDPB — Data controllers in the Netherlands may only process personal data where one of the GDPR Article 6 lawful bases applies, including consent, contractual necessity, legal obligation, vital interests, public-interest task, or legitimate interests.observed
  2. ConfirmedEUR-Lex — Under GDPR Article 8(1), processing of a child's data based on consent for direct offer of information-society services is lawful where the child is at least 16; below that age, parental/guardian consent is required, with Member States able to lower this to no less than 13.observed
  3. ConfirmedIAPP — The Dutch GDPR Implementation Bill reiterates age 16 as the applicable threshold for Article 8 GDPR consent, matching the prior Dutch Data Protection Act age limit rather than exercising the option to lower it to 13.observed
  4. ConfirmedIAPP — UAVG Chapter 3 provides generic exceptions (e.g., explicit consent) alongside specific per-category exceptions allowing defined controllers such as hospitals, schools and insurance companies to process special categories of data for defined purposes (identification, sick-leave management, benefits, pre-employment screening, crime prevention).observed
  5. ConfirmedAP/EDPB — UAVG Article 29 permits processing of biometric data for unique identification only where strictly necessary for authentication or security purposes, addressing a gap in GDPR Article 9 that otherwise lacked a workable workplace-biometrics exception.observed