Data protection & privacy law in Netherlands (2026)

Legal framework

EU General Data Protection Regulation (GDPR / 'AVG', Regulation 2016/679), directly applicable since 25 May 2018, supplemented nationally by the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, UAVG). Supervised and enforced by the Autoriteit Persoonsgegevens (AP).

GDPR & data protection in Netherlands

In Netherlands, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Applies to

any organisation processing the personal data of people in Netherlands, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Netherlands supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Netherlands

1. 01Comprehensive GDPR-based regime

   The GDPR applies directly and is supplemented by the UAVG (BWBR0040940), which entered into force on 25 May 2018, replacing the former Wet bescherming persoonsgegevens (Wbp). The UAVG sets national specifics, exceptions and elaborations and establishes the supervisory authority's powers.

   wetten.overheid.nl eerstekamer.nl

2. 02Supervisory authority (AP)

   The Autoriteit Persoonsgegevens (AP), the independent Dutch Data Protection Authority (formerly the College bescherming persoonsgegevens), supervises and enforces the GDPR and UAVG, handles complaints, conducts investigations and issues guidance.

   autoriteitpersoonsgegevens.nl autoriteitpersoonsgegevens.nl

3. 03Core obligations and rights

   Processing must rest on one of the six GDPR legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests). Controllers must meet the accountability principle, and data subjects hold rights of access, rectification, erasure, data portability and objection.

   autoriteitpersoonsgegevens.nl autoriteitpersoonsgegevens.nl

4. 04Cookies and ePrivacy

   Cookie placement is governed by Article 11.7a of the Telecommunicatiewet (the Dutch implementation of the EU ePrivacy Directive), while the GDPR governs use of the resulting data. Non-essential cookies require prior, freely given consent; cookie walls are prohibited, and the AP enforces these rules.

   autoriteitpersoonsgegevens.nl

5. 05National derogation: age of digital consent

   Using the GDPR's margin for member states, the UAVG sets the age of valid digital consent for information-society services at 16, the maximum permitted; below that age parental/guardian consent is required.

   wetten.overheid.nl autoriteitpersoonsgegevens.nl

6. 06Enforcement and sanctions

   The AP can impose administrative fines up to €20 million or 4% of worldwide annual turnover. Recent actions include a €290 million fine against Uber in 2024 over EU-to-US driver-data transfers and a 2025 enforcement campaign warning 200+ websites over non-compliant cookie banners.

   autoriteitpersoonsgegevens.nl

GDPR in Netherlands: FAQ

Timeline of decisions

1. 1 Apr 2025Enforcement · official
   AP Launches Mass Cookie-Consent Enforcement Campaign

   The Dutch DPA sent warning letters to more than 200 websites for cookie banners lacking a genuine 'reject' option or loading tracking scripts before user consent. A dedicated annual budget of €500,000 funds a target of 500 warnings per year, signalling systematic enforcement of ePrivacy/GDPR consent rules.

   Autoriteit Persoonsgegevens

2. 3 Sept 2024Enforcement · official
   Clearview AI Fined €30.5 Million for Illegal Biometric Facial-Recognition Database

   The AP fined Clearview AI €30.5 million for scraping billions of photos from the internet to build a facial-recognition database without a lawful basis under GDPR. The AP simultaneously warned Dutch organisations that any use of Clearview's services is itself unlawful.

   European Data Protection Board

3. 26 Aug 2024Enforcement · official
   Uber Fined €290 Million, Largest-Ever Dutch DPA Penalty

   The AP imposed a €290 million fine on Uber for transferring sensitive personal data of European taxi drivers to US servers for over two years without any approved transfer mechanism after Standard Contractual Clauses lapsed in August 2021, violating GDPR Chapter V. This remains the largest fine ever issued by the Dutch DPA.

   Autoriteit Persoonsgegevens

4. 12 Apr 2022Enforcement · official
   Tax Administration Fined €3.7 Million for Discriminatory Fraud-Detection Blacklist (Toeslagenaffaire)

   The AP fined the Belastingdienst €3.7 million for operating the FSV fraud blacklist in breach of GDPR, and separately €2.75 million for unlawfully processing applicants' nationality data as a discriminatory fraud indicator for years. The scandal, which wrongly accused tens of thousands of families, became a landmark case for algorithmic discrimination and data-protection enforcement against the state.

   Autoriteit Persoonsgegevens

5. 1 Jul 2021Enforcement · official
   TikTok Fined €750,000 for English-Only Privacy Notice Inaccessible to Dutch Children

   The AP fined TikTok for presenting its privacy policy solely in English to Dutch users, including young children, between May 2018 and July 2020, preventing meaningful informed consent. The case reinforced that children's data requires accessible, language-appropriate disclosures under GDPR.

   Autoriteit Persoonsgegevens

6. 5 Feb 2020Decision · official
   District Court of The Hague Strikes Down SyRI Government Fraud-Detection Algorithm

   The court ruled that the SyRI legislation, a big-data welfare-fraud profiling system, violated Article 8 ECHR due to lack of transparency and disproportionate interference with private life. One of the world's first rulings on human-rights limits of AI in public administration, it led the Dutch government to immediately cease use of SyRI.

   UN Office of the High Commissioner for Human Rights

7. 25 May 2018Law · official
   GDPR and Dutch Implementation Act (UAVG) Enter into Force

   The EU GDPR became directly applicable and the Uitvoeringswet AVG (UAVG) replaced the Wbp. The UAVG set the digital consent age at 16, added employment-data safeguards, and dramatically expanded the AP's sanctioning powers, raising maximum fines to €20 million or 4% of global annual turnover.

   wetten.overheid.nl (Dutch Official Legislation Portal)

8. 1 May 2018Law · official
   Intelligence and Security Services Act 2017 (Wiv 2017) Enters into Force

   Despite a citizen-initiated advisory referendum on 21 March 2018 in which 49.4% voted against it, the Wiv 2017 entered into force on 1 May 2018, legalising bulk cable (internet backbone) interception by the AIVD and MIVD; the Act established two independent oversight bodies, the ex-ante TIB (whose rulings are binding) and the ex-post CTIVD, to check intelligence gathering.

   AIVD

9. 1 Jan 2016Law · official
   Mandatory Data-Breach Notification (Meldplicht Datalekken) and Regulator Renamed Autoriteit Persoonsgegevens

   A Wbp amendment introduced a mandatory 72-hour data-breach notification obligation, one of the first statutory requirements of its kind in the EU, and simultaneously renamed the CBP to the Autoriteit Persoonsgegevens, granting it stronger sanctioning powers ahead of GDPR.

   Autoriteit Persoonsgegevens

10. 1 Sept 2001Law · official
    Personal Data Protection Act (Wbp) Enters into Force, CBP Established

    The Wet bescherming persoonsgegevens (adopted 6 July 2000) entered into force on 1 September 2001, implementing EU Directive 95/46/EC. It replaced the 1989 Wpr with broader definitions, stronger individual rights, and transformed the Registratiekamer into the College Bescherming Persoonsgegevens (CBP) with enhanced enforcement powers.

    Council of Europe (official Wbp text)

11. 1 Jan 1989Law · official
    Personal Data Registration Act (Wpr) and Registratiekamer Established

    The Netherlands enacted its first comprehensive data-protection statute, the Wet persoonsregistraties (Wpr), and created the independent Registratiekamer as the supervisory authority, the direct institutional forerunner of today's AP. This gave Dutch citizens formal, enforceable rights over their registered personal data for the first time.

    Autoriteit Persoonsgegevens

Sources

1. 1.wetten.overheid.nl/BWBR0040940/
2. 2.eerstekamer.nl/wetsvoorstel/34851_uitvoeringswet_algemene
3. 3.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/gdpr-basics/the-gdpr-in-brief
4. 4.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/gdpr-basics/legal-bases-from-the-gdpr-explained
5. 5.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/gdpr-basics/accountability-principle
6. 6.autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/cookies
7. 7.autoriteitpersoonsgegevens.nl/en/about-the-ap/fines-and-other-sanctions-from-the-ap