--- title: "Netherlands — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/netherlands/regulator-and-framework/ source_html: /jurisdictions/netherlands/regulator-and-framework/index.html description: "Netherlands — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 7 claims Green ▾ # Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral w" generated_at: 2026-10-25T04:46:50Z content_sha256: ef01be1891c786870b87bfe94e9c2779efaa9af905c0f2a63012e8f870b0a3e7 generator: "fe-fleet/md-twin@1.0" --- # Netherlands — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules7 claimsGreen▾# Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations. #### Sub-modules (5) #### Regulator And AuthorityGreen The AP is the Article 51(1) GDPR supervisory authority, established under UAVG Chapter 2, headquartered in The Hague, currently chaired by Aleid Wolfsen. Claims (1): - The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR. #### Act And InstrumentsGreen GDPR applies directly; UAVG supplements it in a policy-neutral manner, continuing pre-GDPR Dutch law insofar as permitted. Claims (3): - The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR. - Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty. - Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81. #### Material ScopeGreen UAVG Article 2 applies to processing wholly or partly by automated means and to non-automated processing forming part of a filing system, mirroring GDPR Article 2/4. Claims (1): - UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system. #### Territorial ScopeGreen The UAVG/GDPR regime extends to controllers/processors established in NL and to non-established controllers offering goods/services to, or monitoring the behaviour of, individuals in NL. Claims (1): - The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands. #### Regulator Registration And FilingAmber General notification duties were abolished under GDPR; a legacy Ministry-issued BCR permit regime was superseded by AP authorisation, with a risk of lapse absent timely AP action. Claims (1): - Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation. Category narrative 103 words The Netherlands is an EU Member State operating under the GDPR as the omnibus instrument, implemented and supplemented domestically by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). The Autoriteit Persoonsgegevens (AP), seated in The Hague, is the designated national supervisory authority under Article 51(1) GDPR. Material and territorial scope follow the GDPR text as implemented policy-neutrally by the UAVG, including extraterritorial reach to non-established controllers targeting NL data subjects or monitoring behaviour occurring in NL. General notification/registration to the AP was abolished under GDPR in favour of accountability (ROPA, DPIA); a legacy BCR-permit regime under the Minister of Justice was replaced by AP authorisation. no periodic updates on record for this sub-brief Evidence 7 Sources and claims (7) - Confirmed[EDPB](https://www.edpb.europa.eu/about-edpb/our-members_en) — The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR.observed 2026-08-03 - Confirmed[DataGuidance](https://www.dataguidance.com/sites/default/files/dutch_general_general_data_protection_regulation_implemention_act.pdf) — UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation.observed 2026-08-03 - Confirmed[Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_The_Netherlands.aspx) — Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty. - Confirmed[Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_The_Netherlands.aspx) — Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81.