Privacy policy in the Netherlands: what it must contain under the GDPR

Under arts. 12, 13 and 14 of the GDPR you must tell people who you are, why and on what legal basis you process their data, who receives it, how long you keep it and which rights they have; on a website, a privacy statement (privacyverklaring) is the practical way to do that. A statement copied from a competitor or a generator usually fails, and in 2026 the European Data Protection Board chose these transparency obligations as the theme of a coordinated enforcement action by national supervisors. In the Netherlands that supervisor is the Autoriteit Persoonsgegevens (AP).

Where does the duty to publish a privacy statement come from?

No article of the GDPR is headed “privacy policy”. The statement is simply the ordinary way of discharging an obligation the GDPR frames differently — as the individual’s right to be informed. Transparency is a principle in art. 5 GDPR; arts. 12, 13 and 14 GDPR turn it into a concrete list of things you must tell people, and a standard for how.

The split between art. 13 and art. 14 matters more than most companies realise.

• Art. 13 GDPR applies where you collect personal data from the individual — a contact form, a checkout, a newsletter sign-up. The information must be given at the time the data are obtained: before the form is submitted, not after.
• Art. 14 GDPR applies where the data came from elsewhere — a data broker, a public register, a scraped source, a partner, an employer. You must inform the individual within a reasonable period and at the latest within one month, or at first communication with them, or when the data are first disclosed to another recipient, whichever comes first.

Art. 14 carries a small set of exceptions — the individual already has the information, informing them is impossible or would involve disproportionate effort, the obtaining or disclosure is expressly laid down by law, or the data are subject to professional secrecy. These are narrow. “Inconvenient” is not disproportionate effort, and a company that buys or scrapes contact data and never tells anyone is relying on an exception that does not exist.

Art. 12 GDPR governs the manner: concise, transparent, intelligible, easily accessible, in clear and plain language.

What must a privacy statement contain?

This is not a menu. A statement missing one of these items is incomplete as a matter of law.

Three items deserve a closer look, because that is where the AP’s attention lands.

Why isn’t “our partners” a good enough answer on recipients?

Art. 13 and art. 14 GDPR allow recipients or categories of recipients. That is a genuine choice, but a category has to mean something. “Our partners” is not a category; it is a refusal to answer. “Our payment service provider, our hosting provider in Germany, our email marketing platform in the United States, and the advertising networks named in our cookie statement” is. If you cannot describe a recipient without vagueness, you probably do not know who has the data — a bigger problem.

What if you cannot give a fixed retention period?

The GDPR accepts that a number of days cannot always be given, which is why art. 13 permits the criteria used to determine the period instead. What it does not permit is the non-answer. In a 2023 decision fining Uber Technologies Inc. and Uber B.V. €10,000,000, the AP found exactly that: the statement said data would be kept as long as necessary, which it held too general. A workable criterion reads “for the duration of the contract and seven years after the last transaction, in line with Dutch tax law”.

What has to be said about transfers outside the EEA?

Saying data “may be transferred outside the European Economic Area” tells the reader nothing. In the same Uber case, the AP’s position was that the destination countries should be named and the safeguard identified — adequacy decision, standard contractual clauses, binding corporate rules — with how to obtain a copy. Companies using US analytics, CRM or cloud hosting are transferring; the only question is whether the statement admits it.

What form must the statement take?

Art. 12 GDPR sets a standard that is easy to state and often failed:

• Concise and transparent — presented efficiently and clearly separated from terms and conditions. Burying it in the general terms does not comply.
• Intelligible — understandable by an average member of the intended audience. A statement written for American lawyers is not intelligible to Dutch consumers, and neither is an English-only statement on a Dutch-language site.
• Easily accessible — the reader should not have to hunt. European guidance treats it as needing to be immediately apparent: a direct link from every page, a contextual link at the point of collection, and in an app a couple of taps away at most.
• Clear and plain language — concrete and definitive rather than abstract. European guidance singles out hedging words such as “may”, “might” and “possible”, and treats phrases like “we may use your personal data to develop new services” or “for research purposes” as examples of what not to write.

Where a service is addressed to children, or you know children use it heavily, art. 12 requires vocabulary, tone and style to be adapted so a child can understand it. In the Netherlands this bites early: under art. 5 of the Uitvoeringswet AVG (the Dutch GDPR Implementation Act), the age below which parental consent is needed for information society services offered directly to a child is sixteen, the highest the GDPR allows. A statement written for adults on a service used by fourteen-year-olds fails, and the child’s own right to be informed is not discharged by informing the parent.

How does a layered privacy statement work?

Layering is the recommended answer to the tension between completeness and readability, and both the AP and European guidance endorse it. Done properly, the first layer carries the controller’s identity, the purposes, the processing with the greatest impact or capacity to surprise, and how to exercise rights — with the full text one click away as a single document.

Done improperly it becomes a way of hiding things. Layers must not contradict each other, the complete information must remain available in one place, and nothing may be demoted because it is embarrassing. If a processing operation would surprise the reader, that is an argument for the first layer, not the fourth.

Where do privacy statements go wrong?

The recurring failures are few, and predictable.

• Vague purposes and undisclosed sharing. “To improve our services” describes nothing, and “we may share your data with selected partners” is the commonest defect of all — it usually conceals ad tech. The test is whether a reader can tell what happens to their data and decide whether they mind.
• A statement that contradicts the site. This turns a paperwork problem into an enforcement problem. The statement says no tracking cookies are placed without consent while the tag manager fires on page load; it says data stay in the EU while the support desk runs on a US platform. A regulator does not need to read the statement carefully to find this. It needs to open the network tab.
• The copied statement. A policy taken from a competitor describes the competitor’s processing: it names recipients you do not use, omits the ones you do, and states retention periods you do not observe. It is a set of false statements about your own business.

Is a privacy statement the same as a cookie notice?

No. These are two obligations under two instruments, and conflating them is a reliable way to comply with neither.

Cookies and comparable techniques are governed in the Netherlands by art. 11.7a of the Telecommunicatiewet, implementing the ePrivacy Directive. Anyone storing information on, or accessing information stored in, a user’s terminal equipment must give clear and complete information and obtain consent, with narrow exemptions for what is strictly necessary to transmit the communication or deliver the service requested. This governs the act of reading or writing on the device, whether or not personal data are involved. The GDPR governs what you then do with any resulting personal data.

So: the banner is where consent is given or refused; the cookie statement lists the cookies, their purposes and durations; the privacy statement explains the processing of personal data. A privacy statement cannot obtain consent, and a banner cannot discharge arts. 13 and 14. Cross-reference them, and keep them consistent.

The AP has stepped up its monitoring of Dutch cookie banners since 2025, writing to organisations whose banners use pre-ticked boxes, an easier route to accept than to refuse, or options that are hard to find. Most organisations approached have since adjusted their banners; the AP has opened investigations into those that have not.

How do you build an accurate statement, instead of copying one?

Art. 30 GDPR requires most organisations to maintain a register of processing activities — the verwerkingsregister. For each activity it records the purposes, the categories of data subject and of personal data, the recipients including those in third countries, the transfer safeguards and the retention periods. Where a recipient is a processor, the same facts should already appear in the data processing agreement with that party, which makes register and statement far easier to keep aligned.

Compare that with the table above: the overlap is nearly total. The register is the factual inventory; the privacy statement is its public rendering. Built in that order, the statement is accurate by construction and stays accurate, because updating the register updates the source. Written the other way round, the two drift apart — and a regulator that asks for the register and reads the website sees the gap.

How do you keep the statement current?

A privacy statement describes a live system, so it goes stale whenever the system changes: a new analytics tool, a new CRM, a new processor abroad, a new purpose for data already held.

Two rules follow. A change of processing is a change to the statement, and it should be revised before the change goes live. And a material change must be actively communicated: European guidance is firm that leaving individuals to notice a revised policy themselves is not sufficient. Substantive changes — a new purpose, a change of controller, a change in how rights are exercised — should be brought to people’s attention by email or on-site notice, far enough in advance that they can withdraw consent or object. A typo needs no announcement. A new purpose does.

Version-date the statement and keep previous versions. If you need to show what you told a customer in 2024, an undated live page will not do it.

Does the obligation apply to companies established outside the EU?

A company with no EU establishment is caught by art. 3 GDPR if it offers goods or services to people in the EU or monitors their behaviour there. Mere accessibility of a website is not enough; what counts is evidence of targeting — a Dutch-language version, euro pricing, delivery to the Netherlands, a .nl domain, Dutch advertising. Behavioural monitoring of EU visitors is an independent trigger.

If art. 3 applies, art. 27 GDPR generally requires a representative in the Union, established in a member state where the relevant data subjects are, whose identity and contact details belong in the privacy statement. The exemption is narrow: processing that is occasional, does not involve large-scale special category data, and is unlikely to result in a risk. A webshop selling continuously into the Dutch market is not occasional.

The AP has enforced this in isolation, fining Locatefamily.com €525,000 for failing to designate an EU representative. The breach was of art. 27 read with art. 3 GDPR. The site had no EU establishment and its place of establishment was never firmly identified, which did not prevent the fine — a signal for any non-EU operator assuming distance equals immunity.

How does the AP enforce these rules?

Under art. 6 of the Uitvoeringswet AVG the Autoriteit Persoonsgegevens is the Dutch supervisory authority. Its powers come from art. 58 GDPR — warnings, reprimands, orders, restrictions on processing — and art. 83 GDPR places breaches of arts. 12, 13 and 14 in the higher tier for an administrative fine: up to €20 million or 4% of total worldwide annual turnover, whichever is higher.

The AP treats the information obligation as a standalone breach, not a footnote. Its €10,000,000 fine on Uber rested on arts. 12 and 13 GDPR — retention information too general, transfer destinations not named, the right to data portability not mentioned as such. That is a fine for what a privacy statement did not say. Separately, the AP fined Uber €290,000,000 in 2024 for transferring drivers’ data to the United States without a valid transfer tool.

The near-term risk is higher than usual. The 2026 coordinated enforcement action of the European Data Protection Board targets arts. 12, 13 and 14 GDPR directly: participating authorities approach controllers across sectors through investigations or fact-finding exercises, with follow-up where the findings warrant it.

What should you check as a business?

Compare your statement with what your website and systems actually do; that is how the AP tests it.

• Check that every purpose has a stated legal basis under art. 6 GDPR, and that legitimate interests are named where you rely on them.
• Name recipients or meaningful categories, not “our partners”, and match them against your processing agreements.
• Give a retention period or a usable criterion for each category of data.
• Name the countries outside the EEA you transfer to and the safeguard used for each.
• Check that the statement matches your cookie banner and the tags that actually fire under art. 11.7a Telecommunicatiewet.
• Version-date the statement and update it before a new tool or purpose goes live.

What can we do for you with your privacy statement?

Our IT lawyers advise Dutch and foreign companies on the GDPR duty to inform.

• We review your current privacy statement against arts. 12, 13 and 14 GDPR and list the gaps.
• We draft a statement based on your register of processing activities (art. 30 GDPR).
• We check your cookie banner and cookie statement for consistency with the privacy statement.
• We assess whether you need an EU representative under art. 27 GDPR.
• We assist you when the AP sends questions or opens an investigation.

Summary

• The GDPR does not use the words “privacy policy”, but arts. 12, 13 and 14 make publishing one the only practical way to meet the duty to inform.
• Art. 13 applies to data collected from the individual; art. 14 to data obtained elsewhere, with its own timing rules and a narrow set of exceptions.
• The statement must be concise, intelligible, easily accessible and in plain language — vague wording on recipients, retention and transfers is where enforcement lands.
• Build the statement from your register of processing activities (art. 30 GDPR), not from a competitor’s policy or a generator, and revise it whenever the underlying processing changes.
• If you have no EU establishment but target the Dutch market, check whether you need an EU representative under art. 27 GDPR.

Frequently asked questions