---
title: "Netherlands — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/netherlands/lawful-processing-and-special-data/
source_html: /jurisdictions/netherlands/lawful-processing-and-special-data/index.html
description: "Netherlands — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 5 claims Green ▾ # Core lawful-basis and special-category framework is GDPR-aligned with well-docu"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 7d5cc697e16982961e46f94cb3701409a284ccaf72716708da1cb631d8db2312
generator: "fe-fleet/md-twin@1.0"
---
# Netherlands — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules5 claimsGreen▾#

Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.

Primary framework GDPR Articles 6, 7, 9 as supplemented by UAVG Chapter 3

Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/)

Traffic-light rationale — Green Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.

#### Sub-modules (4)

#### Lawful BasesGreen

The six GDPR Article 6 lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) apply directly and exhaustively in NL.

Claims (1):

- Data controllers in the Netherlands may only process personal data where one of the GDPR Article 6 lawful bases applies, including consent, contractual necessity, legal obligation, vital interests, public-interest task, or legitimate interests.

#### Consent ThresholdsGreen

Consent must be freely given, specific, informed and unambiguous per Article 7 GDPR; NL sets the digital-consent age of majority at 16.

Claims (2):

- Under GDPR Article 8(1), processing of a child's data based on consent for direct offer of information-society services is lawful where the child is at least 16; below that age, parental/guardian consent is required, with Member States able to lower this to no less than 13.
- The Dutch GDPR Implementation Bill reiterates age 16 as the applicable threshold for Article 8 GDPR consent, matching the prior Dutch Data Protection Act age limit rather than exercising the option to lower it to 13.

#### Special CategoriesAmber

UAVG Chapter 3 layers additional, sector-specific exceptions onto GDPR Article 9 for controllers such as hospitals, schools and insurers.

Claims (1):

- UAVG Chapter 3 provides generic exceptions (e.g., explicit consent) alongside specific per-category exceptions allowing defined controllers such as hospitals, schools and insurance companies to process special categories of data for defined purposes (identification, sick-leave management, benefits, pre-employment screening, crime prevention).

#### Pseudonymisation And AnonymisationAmber

Biometric data processing is restricted under UAVG Article 29 to cases of strict necessity for authentication or security purposes, addressing a gap left by the GDPR's blanket Article 9 prohibition.

Claims (1):

- UAVG Article 29 permits processing of biometric data for unique identification only where strictly necessary for authentication or security purposes, addressing a gap in GDPR Article 9 that otherwise lacked a workable workplace-biometrics exception.

Category narrative 94 words

Lawful bases and consent standards follow GDPR Articles 6 and 7 directly. The Netherlands set the child consent age threshold for information-society-service consent at 16 (the GDPR default, not exercising the Member-State option to lower it to as little as 13). UAVG Chapter 3 supplies sector-specific exceptions permitting processing of special-category data (health, biometric, criminal) by defined controller categories (hospitals, schools, insurers) for defined purposes, and restricts biometric processing to strict necessity for authentication/security. A pending 'Data Protection Collective Act' bill would adjust several special-data and children's-consent provisions but is not yet in force.

Evidence 5

Sources and claims (5)
- Confirmed[EDPB](https://www.edpb.europa.eu/sme/be-compliant/process-personal-data-lawfully_en) — Data controllers in the Netherlands may only process personal data where one of the GDPR Article 6 lawful bases applies, including consent, contractual necessity, legal obligation, vital interests, public-interest task, or legitimate interests.observed 2026-08-03
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX%3A02016R0679-20160504) — Under GDPR Article 8(1), processing of a child's data based on consent for direct offer of information-society services is lawful where the child is at least 16; below that age, parental/guardian consent is required, with Member States able to lower this to no less than 13.observed 2026-08-03
- Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The Dutch GDPR Implementation Bill reiterates age 16 as the applicable threshold for Article 8 GDPR consent, matching the prior Dutch Data Protection Act age limit rather than exercising the option to lower it to 13.observed 2026-08-03
- Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — UAVG Chapter 3 provides generic exceptions (e.g., explicit consent) alongside specific per-category exceptions allowing defined controllers such as hospitals, schools and insurance companies to process special categories of data for defined purposes (identification, sick-leave management, benefits, pre-employment screening, crime prevention).observed 2026-08-03
- Confirmed[AP/EDPB](https://www.edpb.europa.eu/sites/default/files/decisions/nl_2020-09-02_-_dpia_list_nl_sa_-_national_decision_en.pdf) — UAVG Article 29 permits processing of biometric data for unique identification only where strictly necessary for authentication or security purposes, addressing a gap in GDPR Article 9 that otherwise lacked a workable workplace-biometrics exception.observed 2026-08-03