#
Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations.
Sub-modules (5)
Regulator And AuthorityGreen
The AP is the Article 51(1) GDPR supervisory authority, established under UAVG Chapter 2, headquartered in The Hague, currently chaired by Aleid Wolfsen.
Claims (1):
- The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR.
Act And InstrumentsGreen
GDPR applies directly; UAVG supplements it in a policy-neutral manner, continuing pre-GDPR Dutch law insofar as permitted.
Claims (3):
- The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR.
- Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty.
- Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81.
Material ScopeGreen
UAVG Article 2 applies to processing wholly or partly by automated means and to non-automated processing forming part of a filing system, mirroring GDPR Article 2/4.
Claims (1):
- UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system.
Territorial ScopeGreen
The UAVG/GDPR regime extends to controllers/processors established in NL and to non-established controllers offering goods/services to, or monitoring the behaviour of, individuals in NL.
Claims (1):
- The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands.
Regulator Registration And FilingAmber
General notification duties were abolished under GDPR; a legacy Ministry-issued BCR permit regime was superseded by AP authorisation, with a risk of lapse absent timely AP action.
Claims (1):
- Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation.
no periodic updates on record for this sub-brief
Sources and claims (7)
- ConfirmedEDPB — The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR.observed
- ConfirmedIAPP — The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR.observed
- ConfirmedDataGuidance — UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system.observed
- ConfirmedIAPP — The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands.observed
- ProbableIAPP — Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation.observed
- ConfirmedMultilaw — Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty.
- ConfirmedMultilaw — Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81.