Data Protection Monitor
Global Privacy & Data Protection Intelligence

Netherlands Data Protection & Privacy Regulation

NL schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 126 claims · 111 sources in the cumulative register

The Autoriteit Persoonsgegevens (AP) published a vision document on generative artificial intelligence on 4 February 2026, naming artificial intelligence as a top enforcement priority for 2026 and beyond.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups (5 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityAutoriteit Persoonsgegevens (AP)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)2027CJEU appeal in EU-US DPF adequacy challenge (C-703/25 P)
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Law made at European Economic Area (Bloc) level that applies in Netherlands is covered once, on the European Economic Area (Bloc) page. This page covers Netherlands’s own layer: implementation, national authorities, national options and local enforcement.

Jurisdiction brief

Latest update · 4 November 2026

Lead Signal

The Dutch Autoriteit Persoonsgegevens combined its largest-ever sanction with a structural transparency reform, materially raising the stakes of GDPR non-compliance in the Netherlands. The AP fined Uber EUR824,990,000 on 21 August 2026 for breaching Article 22 GDPR's prohibition on solely-automated decisions with significant effect, arising from automated driver-account deactivations between 2018 and 2022 conducted without meaningful human review, compounded by inadequate information given to affected drivers. The fine is the AP's fourth against Uber and the second-largest GDPR fine issued anywhere in the EU, after Meta's EUR1.2 billion penalty; Uber has announced it will appeal. The size and basis of the fine signal that automated decision-making without a genuine human-review layer remains a top-tier enforcement target for the AP, even where the underlying processing long preceded the enforcement action. Alongside this, a new procedural rule under Article 21b of the Uitvoeringswet AVG, introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026, establishes publication as the default position for AP enforcement decisions, including orders, fines and settlements, which must now be published no earlier than two weeks after the decision absent an exception applying. Together, the record fine and the new default-publication rule mean that both the financial and reputational consequences of an AP enforcement decision have increased in the same period.

Key regulatory facts for Netherlands
Regulatory DimensionNetherlands Standing Position
JurisdictionNetherlands (NL)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 126 sourced findings)
Regulator & FrameworkComprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations.
Lawful Processing & Special DataCore lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.
Data Subject RightsDirectly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices.
Controller/Processor DutiesFull GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling.
Primary Instruments CitedEDPB, IAPP, DataGuidance, Multilaw, AVG Juristen
Last Confirmed / Updated2026-11-04 (111 sources in cumulative register)

#

Comprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations.

Primary frameworkGDPR (Regulation (EU) 2016/679) as implemented by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenComprehensive, mature omnibus regime fully aligned with GDPR; UAVG implementation is policy-neutral with narrow, well-documented derogations.

Sub-modules (5)

Regulator And AuthorityGreen

The AP is the Article 51(1) GDPR supervisory authority, established under UAVG Chapter 2, headquartered in The Hague, currently chaired by Aleid Wolfsen.

Claims (3):

  • The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR.
  • Autoriteit Persoonsgegevens (AP) — The Netherlands' independent national data protection supervisory authority under Article 51 GDPR.
  • Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) — AP is the national GDPR supervisory authority, designated under art. 51(1) GDPR via UAVG

Act And InstrumentsGreen

GDPR applies directly; UAVG supplements it in a policy-neutral manner, continuing pre-GDPR Dutch law insofar as permitted.

Claims (8):

  • The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR.
  • Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty.
  • Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81.
  • Verzamelwet gegevensbescherming (UAVG amendment) — Amendments to UAVG (minors' rights, narrower criminal-data definition, stricter biometric conditions, mandatory publication of AP sanction decisions) commenced 2026-09-01 by royal decree of 2026-07-09, except one biometric-data provision (art. 29 UAVG) held back
  • Verzamelwet gegevensbescherming — Art. 21b UAVG establishes 'openbaar, tenzij' (public unless) as the default for AP enforcement decisions (orders, fines, settlements), to be published at the earliest two weeks after the decision.
  • UAVG (proposed amendment) — A proposal to amend the UAVG is in consultation as of 2026, including provisions to allow children aged 12 and above to make independent data-subject requests and to narrow the definition of criminal personal data.
  • GDPR + UAVG — Dutch data protection law rests on the directly-applicable GDPR and the national UAVG, both in force since 25 May 2018.
  • Verzamelwet gegevensbescherming — Art 41 UAVG tightened at consultation stage; AP raised compatibility doubt with Art 23 GDPR

Material ScopeGreen

UAVG Article 2 applies to processing wholly or partly by automated means and to non-automated processing forming part of a filing system, mirroring GDPR Article 2/4.

Claims (1):

  • UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system.

Territorial ScopeGreen

The UAVG/GDPR regime extends to controllers/processors established in NL and to non-established controllers offering goods/services to, or monitoring the behaviour of, individuals in NL.

Claims (1):

  • The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands.

Regulator Registration And FilingAmber

General notification duties were abolished under GDPR; a legacy Ministry-issued BCR permit regime was superseded by AP authorisation, with a risk of lapse absent timely AP action.

Claims (2):

  • Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation.
  • Autoriteit Persoonsgegevens (AP) — Organisations to register a Data Protection Officer online with the AP, free of charge, whether the appointment is mandatory or voluntary.
Category narrative 103 words

The Netherlands is an EU Member State operating under the GDPR as the omnibus instrument, implemented and supplemented domestically by the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). The Autoriteit Persoonsgegevens (AP), seated in The Hague, is the designated national supervisory authority under Article 51(1) GDPR. Material and territorial scope follow the GDPR text as implemented policy-neutrally by the UAVG, including extraterritorial reach to non-established controllers targeting NL data subjects or monitoring behaviour occurring in NL. General notification/registration to the AP was abolished under GDPR in favour of accountability (ROPA, DPIA); a legacy BCR-permit regime under the Minister of Justice was replaced by AP authorisation.

Periodic update · new data 2026-11-04

Regulator & Framework

A new procedural reform has taken effect under article 21b of the Uitvoeringswet AVG (UAVG), introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026. The provision establishes an 'openbaar, tenzij' (public unless) default for Autoriteit Persoonsgegevens enforcement decisions, covering orders under penalty, cease-and-desist orders, administrative fines, and settlements. Under this default, such decisions are published no earlier than two weeks after the decision is made, absent an applicable exception. This is a procedural-transparency reform rather than a change to the AP's substantive powers: it alters when and how the outcome of an enforcement action becomes public, not what the AP may do. The reform materially changes the reputational consequence that follows an AP sanction, since publication is now the default position rather than a discretionary choice made case by case.

The exact article number and full commencement scope of the Verzamelwet gegevensbescherming beyond article 21b UAVG specifically have not been independently verified at primary source.

Outlook

The item to watch is how the default-publication regime operates in practice: the first enforcement decisions published under article 21b from mid-September 2026 onward will show the real-world reputational effect of the reform, and whether any party successfully invokes an exception to delay or prevent publication.

Sources and claims (15)
  1. Confirmed EDPB — The Autoriteit Persoonsgegevens (AP), based in The Hague, is the Dutch national data protection supervisory authority designated under Article 51(1) GDPR. observed
  2. Confirmed IAPP — The Dutch GDPR Implementation Bill (UAVG) supplements the GDPR and is intended to implement it in a policy-neutral manner, continuing prior Dutch data protection law insofar as permitted by the GDPR. observed
  3. Confirmed DataGuidance — UAVG Article 2 provides that the Act and provisions based upon it apply to the processing of personal data wholly or partly by automated means and to processing that forms part of a filing system. observed
  4. Confirmed IAPP — The UAVG supplements GDPR with regard to personal data processed in the context of the activities of an establishment in the Netherlands, or related to offering goods/services to, or monitoring the behaviour of, individuals in the Netherlands. observed
  5. Probable IAPP — Under the pre-GDPR Dutch Data Protection Act, binding corporate rules were authorised via a Ministry of Justice and Security permit; the GDPR Implementation Bill was silent on transitional treatment, creating a risk that such permits would lapse unless the AP issued its own authorisation. observed
  6. Confirmed Multilaw — Autoriteit Persoonsgegevens (AP) requires: New UAVG article 21b requires the AP to publish any decision imposing an administrative sanction (fine, penalty-payment order, processing ban), subject to Woo exceptions, converting prior discretionary policy into a statutory duty. observed
  7. Confirmed Multilaw — Autoriteit Persoonsgegevens (AP) subject to: Publication of an art. 21b sanction decision may not occur earlier than ten working days after notification to the offender, suspended pending a ruling if interim relief is sought under Awb art. 8:81. observed
  8. Probable AVG Juristen — Verzamelwet gegevensbescherming (UAVG amendment) — Amendments to UAVG (minors' rights, narrower criminal-data definition, stricter biometric conditions, mandatory publication of AP sanction decisions) commenced 2026-09-01 by royal decree of 2026-07-09, except one biometric-data provision (art. 29 UAVG) held back observed
  9. Probable Lexology — Verzamelwet gegevensbescherming — Art. 21b UAVG establishes 'openbaar, tenzij' (public unless) as the default for AP enforcement decisions (orders, fines, settlements), to be published at the earliest two weeks after the decision. observed
  10. Uncertain Recording Law — UAVG (proposed amendment) — A proposal to amend the UAVG is in consultation as of 2026, including provisions to allow children aged 12 and above to make independent data-subject requests and to narrow the definition of criminal personal data. observed
  11. Confirmed Stibbe — Autoriteit Persoonsgegevens (AP) — The Netherlands' independent national data protection supervisory authority under Article 51 GDPR. observed
  12. Confirmed mijnevent.nl — GDPR + UAVG — Dutch data protection law rests on the directly-applicable GDPR and the national UAVG, both in force since 25 May 2018. observed
  13. Probable Officiële Bekendmakingen — Autoriteit Persoonsgegevens (AP) — Organisations to register a Data Protection Officer online with the AP, free of charge, whether the appointment is mandatory or voluntary. observed
  14. Confirmed Overheid.nl — Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) — AP is the national GDPR supervisory authority, designated under art. 51(1) GDPR via UAVG observed
  15. Uncertain InView / Onderneming en Recht — Verzamelwet gegevensbescherming — Art 41 UAVG tightened at consultation stage; AP raised compatibility doubt with Art 23 GDPR observed

#

Core lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.

Primary frameworkGDPR Articles 6, 7, 9 as supplemented by UAVG Chapter 3
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenCore lawful-basis and special-category framework is GDPR-aligned with well-documented, narrowly tailored Dutch derogations.
D2 · Lawful Processing — Full Module Record4 sub-modules · 94 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Directly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices.

Primary frameworkGDPR Articles 12-22
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenDirectly-effective GDPR rights regime, actively enforced by the AP against obstructive controller practices.

Sub-modules (5)

Access RightGreen

Access rights follow GDPR Article 15; AP enforcement confirms controllers may not impose disproportionate identity-verification barriers (e.g., mandatory ID-copy uploads) on access/erasure requests.

Claims (3):

  • The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data.
  • Autoriteit Persoonsgegevens (AP) — Data subjects in the Netherlands may exercise GDPR Chapter III rights via the controller, with AP enforcement backing.
  • UAVG Art 41(1) — Access right may be limited on a case-by-case basis to safeguard an Art 23(1) GDPR interest, including protection of the data subject or others' rights; no categorical restriction permitted

Rectification And ErasureGreen

Controllers must notify recipients of any rectification, erasure, or restriction under Article 19 GDPR unless impossible or disproportionate.

Claims (1):

  • Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request.

Restriction And ObjectionGreen

Restriction and objection rights follow GDPR Articles 18 and 21 directly with no NL-specific derogation identified.

Data PortabilityGreen

Portability follows GDPR Article 20, applying where processing is based on consent or contract and carried out by automated means.

Claims (1):

  • Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible.

Deadlines And Response WindowsGreen

Controllers must respond to data subject requests without undue delay and within one month, extendable by two further months for complex/numerous requests, per GDPR Article 12(3).

Claims (3):

  • GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands.
  • Verzamelwet gegevensbescherming (UAVG Art 5 tiered minors regime) — Tiered regime for minors exercising Chapter III GDPR rights from 2026-09-01: under 12 only legal representative acts; 12-16 either data subject or representative; data subject alone may withdraw consent from age 12; guardians represent those under guardianship
  • GDPR Art 12(3)/Art 15 — Controller must respond to an access request within one month, extendable by two further months for complex/numerous requests
Category narrative 48 words

Data subject rights in NL derive directly from GDPR Chapter III (access, rectification, erasure, restriction, objection, portability) with no material Dutch derogation. AP enforcement practice (e.g., the DPG Media Magazines fine) illustrates active supervision of the access/erasure request process, specifically prohibiting disproportionate identity-verification demands that obstruct rights exercise.

Periodic update · new data 2026-09-28

Data Subject Rights

A proposal to amend the UAVG is reported to be in consultation as of 2026, which would extend independent data-subject-request capacity to children aged 12 and above, and would narrow the definition of criminal personal data under Dutch law. This proposal has not been enacted, and its current legislative stage and expected effective date are not established to a primary source this cycle; reports suggest it remains at consultation stage without a confirmed timeline for enactment.

If enacted, this amendment would mark a structural change to who may exercise data-subject rights independently under Dutch law, lowering the effective age threshold for autonomous exercise of access, rectification, and erasure rights below the general default position that typically requires parental involvement for younger data subjects. The narrowing of the criminal-personal-data definition referenced in the same proposal is a related but distinct change affecting the special-category processing rules applicable to criminal-record information.

Outlook

The UAVG amendment's progression from consultation toward a confirmed legislative timetable is the clearest item to watch for the data-subject-rights dimension of the Dutch framework. Until a primary legislative source confirms the stage and expected effective date, this remains a reported but unconfirmed development.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (9)
  1. Confirmed AP/EDPB — The AP fined DPG Media Magazines €525,000 for infringing GDPR Article 12(2) by requiring individuals to upload a copy of their identity document before honouring access or erasure requests, without informing them they could redact data. observed
  2. Confirmed EUR-Lex — Under GDPR Article 19, controllers must communicate any rectification, erasure or restriction of processing to each recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort, and must inform the data subject of those recipients on request. observed
  3. Confirmed EUR-Lex — Under GDPR Article 20, the data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance where technically feasible. observed
  4. Confirmed EUR-Lex — GDPR Article 12(3) requires controllers to respond to data subject rights requests without undue delay and within one month of receipt, extendable by a further two months for complex or numerous requests, applying directly in the Netherlands. observed
  5. Probable mijnevent.nl — Autoriteit Persoonsgegevens (AP) — Data subjects in the Netherlands may exercise GDPR Chapter III rights via the controller, with AP enforcement backing. observed
  6. Confirmed Overheid.nl (Ministerie van Justitie en Veiligheid) — UAVG Art 5(5) (as amended) — A minor data subject who has reached age 16 may bring proceedings for breach of GDPR rights without assistance of their legal representative observed
  7. Probable AVG Juristen — Verzamelwet gegevensbescherming (UAVG Art 5 tiered minors regime) — Tiered regime for minors exercising Chapter III GDPR rights from 2026-09-01: under 12 only legal representative acts; 12-16 either data subject or representative; data subject alone may withdraw consent from age 12; guardians represent those under guardianship observed
  8. Probable Belastingdienst Kennisgroepen — GDPR Art 12(3)/Art 15 — Controller must respond to an access request within one month, extendable by two further months for complex/numerous requests observed
  9. Probable Holla Advocaten — UAVG Art 41(1) — Access right may be limited on a case-by-case basis to safeguard an Art 23(1) GDPR interest, including protection of the data subject or others' rights; no categorical restriction permitted observed

#

Full GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling.

Primary frameworkGDPR Articles 24-39, UAVG, Works Councils Act (WOR) Article 27
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenFull GDPR accountability regime in force, reinforced by an AP-published DPIA trigger list and active enforcement on security/health-data handling.
D4 · Controller & Processor — Full Module Record7 sub-modules · 75 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Standard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified.

Primary frameworkGDPR Articles 44-49
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenStandard GDPR Chapter V transfer toolkit applies uniformly; no NL-specific localisation mandate identified.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 63 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Telecoms/ePrivacy and employment overlays are well documented; credit-scoring and education sub-modules lack NL-specific findings.

Primary frameworkTelecommunicatiewet (transposing ePrivacy Directive 2002/58/EC); UAVG Chapter 3; Works Councils Act (WOR)
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — AmberTelecoms/ePrivacy and employment overlays are well documented; credit-scoring and education sub-modules lack NL-specific findings.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 69 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Cookie and direct-marketing rules are well documented; dark-pattern, opt-out-signal, clean-room and cross-context-advertising sub-modules lack NL-specific findings.

Primary frameworkTelecommunicatiewet (ePrivacy transposition); GDPR
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — AmberCookie and direct-marketing rules are well documented; dark-pattern, opt-out-signal, clean-room and cross-context-advertising sub-modules lack NL-specific findings.
Periodic update · new data 2026-11-04

AdTech & Commercial Privacy

Since 1 July 2026, businesses may no longer call consumers for telemarketing purposes without consent under the amended Telecommunicatiewet, even where the consumer is, or has been, a customer of that business. This closes the telephone-channel soft opt-in that previously permitted calls to existing customers without separate consent. The amendment is limited in scope: it applies to telephone calls only and does not alter the separate existing-customer soft opt-in for email and SMS marketing preserved under article 11.7(4) of the Telecommunicatiewet. The amendment also carves out charities, lotteries that donate proceeds to charity, and periodical publishers from the tightened consent requirement.

This is the one confirmed in-force change to the Dutch direct-marketing framework; no cookie-consent-specific or broader adtech development was independently re-verified in this window.

Outlook

Businesses that previously relied on the existing-customer telephone soft opt-in will need to have obtained affirmative consent before any telemarketing call made since 1 July 2026; the practical enforcement pattern around this change, including whether the Autoriteit Persoonsgegevens or another body brings early test cases, is the item to watch.

Periodic update · new data 2026-10-11

AdTech & Commercial Privacy

Since 1 July 2026, businesses may no longer call consumers for telemarketing purposes without consent under the amended Telecommunicatiewet, even where the consumer is, or has been, a customer of that business. This closes the telephone-channel soft opt-in that previously permitted calls to existing customers without separate consent. The amendment is limited in scope: it applies to telephone calls only and does not alter the separate existing-customer soft opt-in for email and SMS marketing preserved under article 11.7(4) of the Telecommunicatiewet. The amendment also carves out charities, lotteries that donate proceeds to charity, and periodical publishers from the tightened consent requirement.

This is the one confirmed in-force change to the Dutch direct-marketing framework this cycle; no cookie-consent-specific or broader adtech development was independently re-verified in this window.

Outlook

Businesses that previously relied on the existing-customer telephone soft opt-in will need to have obtained affirmative consent before any telemarketing call made since 1 July 2026; the practical enforcement pattern around this change, including whether the Autoriteit Persoonsgegevens or another body brings early test cases, is the item to watch.

D7 · AdTech & Marketing — Full Module Record6 sub-modules · 64 words · 11 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Biometric and profiling rules are well established under GDPR/UAVG; AI Act competent-authority designation and NL-specific AI risk-assessment interplay is still maturing as of the 2 August 2026 application date.

Primary frameworkGDPR Article 22; UAVG Article 29; EU AI Act (Regulation (EU) 2024/1689); Law Enforcement Directive (2016/680)
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — AmberBiometric and profiling rules are well established under GDPR/UAVG; AI Act competent-authority designation and NL-specific AI risk-assessment interplay is still maturing as of the 2 August 2026 application date.
Periodic update · new data 2026-10-11

Algorithmic, Biometric & Surveillance Governance

The Autoriteit Persoonsgegevens fined Uber EUR824,990,000 on 21 August 2026 for breaching Article 22 of the GDPR, which prohibits decisions based solely on automated processing that produce a significant effect on the data subject, absent a lawful basis and adequate safeguards. The breach arose from Uber's automated deactivation of driver accounts between 2018 and 2022 without what the AP found to be meaningful human review, compounded by inadequate information given to affected drivers about the basis for deactivation. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU, behind only Meta's EUR1.2 billion penalty. Uber has announced it will appeal the decision.

Separately, and at an earlier stage of development, the Dutch government published a draft Uitvoeringswet AI-verordening (Uvai) for consultation on 20 April 2026, with the consultation period closing 1 June 2026. The draft designates the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur as joint coordinators of a decentralised, sector-based market-surveillance model for AI Act supervision in the Netherlands, with anticipated entry into force on 2 August 2027. The Netherlands had missed the EU's own August 2025 deadline for designating AI Act supervisory authorities, so this draft represents a belated structural response rather than an early-adopter position.

Outlook

Whether the Uber appeal proceeds, and on what grounds, will test the durability of the AP's Article 22 theory of automated decision-making without meaningful human review. Separately, whether the draft Uvai has progressed from the closed consultation toward formal introduction before the Tweede Kamer since 1 June 2026 has not been independently verified and remains open, as does the draft's anticipated 2 August 2027 entry-into-force date.

Periodic update · new data 2026-09-28

Algorithmic, Biometric & Surveillance Governance

The AP is reported to have fined Uber EUR824,990,000 on 21 August 2026 for operating automated systems that deactivated driver accounts without human review, a decision reported to breach the GDPR's Article 22 prohibition on solely automated decision-making that produces significant effects on individuals. This fine is described as the second-largest GDPR fine on record, reflecting the scale of exposure the AP is prepared to impose for automated-decision-making violations affecting a large population of gig-economy workers.

The scale of this fine signals that the AP treats unlawful automated decision-making, specifically decisions taken without meaningful human review that carry significant consequences for affected individuals such as loss of livelihood through account deactivation, as among the most serious categories of GDPR violation it currently enforces. The AP has separately been reported to enforce EU AI Act prohibited-practices provisions since February 2025, indicating an emerging institutional focus on algorithmic-system oversight that extends beyond GDPR Article 22 into the newer AI-specific regulatory framework.

Outlook

Whether Uber challenges the AP's decision, and how any appeal addresses the automated-decision-making findings, is the clearest item to watch. More broadly, the AP's parallel enforcement role under both GDPR Article 22 and the AI Act's prohibited-practices provisions positions it as an increasingly significant algorithmic-governance enforcer, worth monitoring as its supervisory focus areas for 2026 become clearer.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 101 words · 17 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status.

Primary frameworkGDPR Article 8; UAVG Article 5
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenAge-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status.
Periodic update · new data 2026-09-28

Children & Vulnerable Groups

A proposed amendment to the UAVG, reported to be in consultation as of 2026, would allow children aged 12 and above to make independent data-subject requests under Dutch data protection law. This proposal is not yet enacted, and reports suggest it remains at consultation stage without a confirmed timeline for entry into force.

If adopted, this would represent a structural shift in how Dutch law treats the data-protection agency of minors, granting a defined age cohort, 12 and above, the standing to exercise data-subject rights independently rather than through a parent or guardian. This is a notable departure from data-protection frameworks that set the age of independent digital consent higher, and its progress is worth tracking distinctly from the general data-subject-rights item given its specific focus on the vulnerable-groups dimension of Dutch law.

Outlook

The UAVG amendment's consultation status means no confirmed effective date exists yet for the children's independent-request provision. Its progression toward enactment is the key marker to watch for this module, alongside any further detail on how the narrowed criminal-personal-data definition referenced in the same proposal would apply to minors specifically.

D9 · Children's Privacy — Full Module Record5 sub-modules · 71 words · 9 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Mature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option.

Primary frameworkGDPR Articles 58, 77-84; UAVG
Supervisory authorityAutoriteit Persoonsgegevens (AP)
Traffic-light rationale — GreenMature, actively used enforcement toolkit with a published fining structure and recent illustrative decisions; collective-redress mechanism is narrower than the GDPR default option.
Periodic update · new data 2026-10-11

Enforcement & Redress

The Autoriteit Persoonsgegevens imposed a fine of EUR824,990,000 on Uber on 21 August 2026 for breaching Article 22 of the GDPR through automated, insufficiently human-reviewed driver-account deactivations between 2018 and 2022, combined with inadequate information provided to affected drivers. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU to date, exceeded only by Meta's EUR1.2 billion penalty. Uber has publicly announced its intention to appeal.

This record-scale sanction arrives alongside a structural change to how AP enforcement outcomes reach the public. Article 21b of the Uitvoeringswet AVG, introduced by the Verzamelwet gegevensbescherming and in force since 1 September 2026, makes publication the default position for AP enforcement decisions, including orders, fines and settlements, publishable no earlier than two weeks after the decision absent an exception. Taken together, the Uber fine and the new publication default mean that both the scale and the visibility of AP enforcement action have increased within the same period, raising the practical consequence of any future AP sanction for a regulated entity.

Outlook

The Uber appeal is the primary near-term item to watch, both for its outcome and for what it may reveal about the durability of the AP's Article 22 automated-decision-making theory. The first enforcement decisions published under the new article 21b default-publication regime, expected from mid-September 2026 onward, will be the first real test of how the transparency reform operates in practice.

Periodic update · new data 2026-09-28

Enforcement & Redress

The Netherlands' enforcement and redress landscape shifted materially this cycle through two nine-figure AP fines and a new statutory transparency obligation. The AP fined MLU B.V. (Yango) EUR100 million on 8 May 2026 for unlawful cross-border data transfers to Russia, and is reported to have fined Uber EUR824,990,000 on 21 August 2026 for unlawful automated decision-making, together representing a marked escalation in enforcement intensity by the Dutch regulator. The AP's standing statutory fine ceiling remains EUR20 million or 4% of global annual turnover, whichever is higher; both fines this cycle were calculated with reference to parent-company turnover consistent with EDPB fine-calculation guidance, explaining how figures well above the nominal EUR20 million ceiling were reached.

Separately, from 1 September 2026, a new Article 21b under the Verzamelwet gegevensbescherming obliges the AP to publish, by name, any sanction it imposes. This converts what had previously been discretionary publication practice into a statutory duty, meaning the AP's enforcement record will become systematically more visible and consistently published going forward, rather than subject to case-by-case publication decisions.

Outlook

The combination of two nine-figure fines and a new mandatory publication duty marks the Netherlands as an increasingly assertive enforcement jurisdiction within the GDPR framework. Whether the Yango and Uber fines are appealed, and how the new Article 21b publication duty is applied in practice from 1 September 2026 onward, are the clearest markers to track for this module going forward.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 125 words · 25 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 126 claim(s) (126 category placement(s)), 111 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (39 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 8Children & Vulnerable Groupsparental consent
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy granted
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties