Regulatory enforcement in the Netherlands: supervisors, fines and appeals

Regulatory enforcement in the Netherlands runs almost entirely through administrative law. A Dutch supervisor does not need to go to court to act against you: it may enter your premises, demand your records, order you to stop or to put things right, and impose a fine by decision. The General Administrative Law Act (Algemene wet bestuursrecht, Awb) sets out both those powers and the limits on them, and it is the limits that most companies discover too late.

What a Dutch supervisor may demand

Supervisory powers are set out in chapter 5 of the Awb and apply to every designated toezichthouder, whether from the Autoriteit Persoonsgegevens, the Autoriteit Financiele Markten, De Nederlandsche Bank, the Autoriteit Consument en Markt, the Nederlandse Voedsel- en Warenautoriteit, the Inspectie Leefomgeving en Transport or a municipality. A supervisor may enter any place except a dwelling without the occupant consent, demand information, inspect business records and data carriers and make copies of them, examine goods and stop and inspect vehicles.

Two features of this regime surprise people used to criminal procedure. There is no requirement of suspicion: supervision is preventive, and an inspector may turn up simply because your sector is on this year programme. And the supervisor decides what is necessary for the performance of the task, subject only to the requirement that the power is exercised proportionately and only so far as reasonably needed. Refusing access or delaying a request is itself an offence, and it colours everything that follows.

The duty to cooperate, and where it stops

The Awb imposes a duty on everyone to cooperate with a supervisor within reasonable limits. That duty is real and enforceable, and a business that stonewalls will usually find the supervisor escalating rather than going away. But it has three boundaries that are worth knowing before an inspector is standing in reception.

The first is professional secrecy. Those who are bound to confidentiality by virtue of their office, profession or a statutory provision may refuse to cooperate to the extent that the duty of confidentiality applies. Correspondence with your external Dutch lawyer falls under legal professional privilege (verschoningsrecht). An in-house lawyer admitted to the Dutch bar can rely on it as well, provided the professional statute securing their independence is in place, but that privilege is not recognised by the European Commission in EU competition investigations, so a group that files everything in one system needs to think about where its advice is stored.

The second is the right not to incriminate yourself. As soon as questioning is directed at imposing a punitive sanction, such as an administrative fine, the person questioned is no longer obliged to answer and must be cautioned. The line between supervision and investigation is often crossed in the middle of a conversation, which is precisely why one person, briefed in advance, should handle the exchange.

The third is scope. A supervisor may demand what it needs for its statutory task, not everything it would find interesting. Overbroad requests can and should be narrowed in writing, with reasons, rather than answered in full out of nervousness.

Which supervisor holds which file

Most organisations answer to more than one authority, and the first question in any incident is which of them has jurisdiction, because the powers, the deadlines and the appeal route all follow from that.

• Autoriteit Persoonsgegevens (AP): personal data under the GDPR and the Dutch implementing act, including breach notification and data subject rights.
• AFM and DNB: conduct and prudential supervision of financial undertakings, licensing, governance and reporting.
• ACM: competition, consumer protection and sector regulation for energy, telecoms, transport and post.
• NVWA: food and product safety, labelling, traceability and recalls.
• ILT: transport, environment and housing corporations, including permits and safety management.
• Municipalities and provinces: environmental permits, zoning and use, hospitality and events, and local by-laws.

Overlap is common. A data breach at a payment firm can involve the AP and the AFM at once; a product incident can bring in the NVWA and the ACM on advertising claims. Where two supervisors are involved, sequencing your answers matters: what you tell one becomes available to the other more easily than most companies assume.

The enforcement toolkit

Dutch supervisors work with a small set of instruments and choose between them deliberately. A remedial order is aimed at ending the breach. The order subject to a penalty payment (last onder dwangsom) requires you to act by a date, on pain of a stated sum per day or per breach; administrative coercion (last onder bestuursdwang) allows the authority to do the work itself at your expense. Neither is a punishment in law, which means the safeguards that attach to punitive sanctions do not apply to them and the threshold for imposing them is lower.

The punitive instrument is the administrative fine (bestuurlijke boete). Its maximum is set by the statute that creates the offence, and for data protection by the GDPR itself. Alongside these sit measures that hurt more than money: withdrawal or suspension of a licence, an instruction to the board, a prohibition on a person holding a position in a regulated firm, and publication of the decision. Our article on penalty payment orders and administrative enforcement sets out how the remedial instruments work in practice.

How an administrative fine is imposed

A fine follows a fixed sequence, and each step is an opportunity. Where the sanction is more than trivial, the supervisor draws up a report of the breach. The intended decision is put to you and you are given the chance to state your view (zienswijze) before it is taken. Then comes the decision, with reasons, which is what starts the clock for objection.

Two statutory bars are worth remembering. A person cannot be fined twice for the same conduct. And a breach cannot be dealt with both by administrative fine and by criminal prosecution: the authorities must choose one route, and once one has been taken the other is closed. In practice the choice is made between the supervisor and the Openbaar Ministerie without your involvement, but it determines which set of procedural rights you have and which forum you are heading for.

The size of the fine is not a fixed figure to be accepted. Most supervisors work with published fining policies that set a base amount and then adjust for seriousness, duration, culpability, turnover and recidivism, and they must reduce a fine where it is disproportionate in the individual case. Evidence about the actual harm, about remediation already carried out and about ability to pay belongs in the zienswijze, not in the appeal.

Objection and appeal: the deadline that decides everything

A decision by a Dutch supervisor is an administrative decision, and the route against it is fixed. You file an objection (bezwaar) with the authority that took the decision within six weeks of the date it was sent. Miss that deadline without a valid excuse and the decision becomes final and unassailable, however wrong it was. After the decision on objection, appeal lies to the administrative court, and from there to a higher court.

Which higher court depends on the supervisor. Decisions of the AFM, DNB and the ACM go to the Rotterdam District Court and then to the College van Beroep voor het bedrijfsleven (Trade and Industry Appeals Tribunal). Decisions of the Autoriteit Persoonsgegevens and most municipal decisions go to the district court and then to the Administrative Jurisdiction Division of the Raad van State. Our guides on the objection procedure and on the Council of State explain both stages.

Objection does not suspend the decision. If the order takes effect immediately, or if publication is imminent, a separate application for interim relief (voorlopige voorziening) must be made to the preliminary relief judge of the administrative court. That application is where most of the real fight over publication takes place, and it has to be prepared in days rather than weeks.

Publication is often the heaviest sanction

Several supervisory statutes require the authority to publish a sanction decision, naming the undertaking, and some require publication even before the decision is final. For a licensed firm, a fintech or a food producer, that publication reaches customers, banks and counterparties long before any court has ruled. It can trigger contractual termination rights, bank de-risking and tender exclusions.

Publication is a separate decision and can be challenged separately. Arguments that succeed tend to be concrete: that publication would be disproportionate to the breach, that it would identify individuals unnecessarily, or that the wording misstates what was actually found. Waiting for the substantive appeal is not an option, because by then the effect has occurred.

Building a file that survives an inspection

The compliance work that matters is the work that produces evidence. A policy nobody can show was communicated, applied and tested is worth very little in an inspection, while a modest control with dated records behind it is worth a great deal. Keep an obligations register that ties each rule to a named owner and a process. Keep records of training, of incidents and of what was done about them. Keep the risk assessments and, for personal data, the record of processing activities and the data protection impact assessments; our note on the data processing agreement covers the contractual side of that chain.

When an inspection comes, appoint one point of contact, keep a log of every question and every document handed over, take notes of oral exchanges and confirm them in writing, and answer what was asked rather than what you fear will be asked next. Involve a lawyer at the moment of first contact rather than after the report arrives; the answers given in week one are what the file is built on.

One further point is worth making before an internal investigation is launched in response to a supervisor request. An investigation run by consultants, with findings circulated freely inside the company, produces a document that the supervisor can demand and that will be read as an admission. The same investigation carried out under the instruction of a lawyer, with a clear reporting line and a written scope, keeps the analysis within privilege and still allows the factual findings to be shared where that helps. Deciding this at the start costs nothing; deciding it afterwards is usually impossible.

Where to get help

Regulated sectors have their own layers on top of this framework. Financial and crypto businesses face licensing and client due diligence duties, and our articles on crypto compliance risks and on preventing money laundering set out what supervisors expect there. The general framework in this article applies across all of them, because it is the Awb, not the sector statute, that governs how the power is exercised and how it can be resisted.

Law and More acts for companies during inspections and information requests, prepares zienswijzen, and conducts objection and appeal proceedings against orders, fines and publication decisions. If a supervisor has contacted you, the useful moment to call a compliance lawyer is now rather than after the deadline. Contact Law & More to discuss your position.