Dutch data privacy law consists of the EU General Data Protection Regulation (GDPR, in Dutch AVG) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG). It gives you six main rights against any organisation that holds your personal data, such as access and erasure; the organisation must answer within one month, but it may refuse where it has another legal ground to keep or use the data.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises compliance. If an organisation does not respect your rights, you can complain to the AP, go to court, or claim compensation under Article 82 GDPR.
Table of contents
Which rules apply in the Netherlands?
The GDPR has applied directly since 25 May 2018, together with the UAVG. The UAVG fills in the points the GDPR leaves to national law, such as the processing of the citizen service number (BSN), health data and criminal data.
The rules apply to companies, associations and government bodies in the Netherlands, and to organisations outside the EU that offer goods or services to people in the Netherlands or monitor their behaviour (Article 3 GDPR). Every processing operation needs one of the six legal grounds in Article 6 GDPR, for example consent, a contract or a legitimate interest.
Which rights do you have?
The GDPR gives you six rights that you can use against any organisation. Exercising them in principle costs you nothing (Article 12(5) GDPR).
- Access (Article 15 GDPR): a copy of your data, plus the purposes, recipients, retention period and source.
- Rectification (Article 16 GDPR): correction of incorrect or incomplete data.
- Erasure (Article 17 GDPR): deletion when the data is no longer needed, consent is withdrawn or the processing was unlawful.
- Restriction (Article 18 GDPR): a freeze on processing while a dispute about accuracy or lawfulness is resolved.
- Data portability (Article 20 GDPR): the data you provided, in a usable format, to take to another provider.
- Objection (Article 21 GDPR): an end to processing based on legitimate interest, unless the organisation has compelling grounds; for direct marketing the objection is absolute.
How do you make a request that is hard to refuse?
Send your request in writing, name the article you rely on and keep proof of sending. The organisation must respond within one month; for complex or numerous requests it may extend this by two further months, but it must tell you so within the first month (Article 12(3) GDPR).
The organisation may ask for proof of identity if it has reasonable doubts about who you are. Do not send a full copy of your passport; cover your photo and your BSN, because a private organisation may not process your BSN without a statutory basis under the UAVG.
When may an organisation refuse?
An organisation may refuse erasure if it must keep the data by law. A clear example is the Dutch tax rule that businesses keep their records for seven years (Article 52 of the General Tax Act, AWR).
Other grounds for refusal are the rights of others (for example, a witness statement in an HR file), a request that is manifestly unfounded or excessive (Article 12(5) GDPR), and the exceptions in Article 41 UAVG, such as the prevention and investigation of criminal offences. A refusal must be reasoned and must tell you that you can complain to the AP and go to court.
What can you do if your rights are not respected?
You have three routes, which you can combine. The choice depends on whether you want a decision, an order or money.
- Complaint to the AP (Article 77 GDPR): it costs nothing; the AP decides whether to investigate and can impose an order or a fine.
- Court: against a private organisation, you file a petition (verzoekschrift) with the district court under the UAVG. Against a government body, its answer to your request is a decision (besluit) under the General Administrative Law Act (Awb), which you can challenge by filing an objection (bezwaar) within six weeks.
- Compensation (Article 82 GDPR): for material and non-material damage. The Court of Justice of the EU held in Österreichische Post (CJEU 4 May 2023, C-300/21) that a breach alone is not enough; you must show actual damage, but there is no minimum threshold of seriousness.
In urgent cases, for example when your data is being published online, you can ask the preliminary relief judge (voorzieningenrechter) in summary proceedings (kort geding) for an order to stop.
What does the GDPR require of organisations?
Organisations must be able to show that they comply with the principles of Article 5 GDPR, such as purpose limitation, data minimisation and storage limitation. This is the accountability principle.
A personal data breach that poses a risk must be reported to the AP within 72 hours of discovery (Article 33 GDPR). Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83 GDPR). For special categories such as biometric data, stricter rules apply; see our article on biometric data and GDPR compliance.
What should you check as an individual?
A well-prepared request saves weeks. Check these points before and after you send it.
- Send the request in writing to the organisation’s privacy contact or data protection officer, and keep proof of the date.
- State which right you use and which GDPR article it rests on.
- Diary the one-month deadline under Article 12(3) GDPR.
- Check whether the answer includes purposes, recipients, retention period and source, as Article 15 GDPR requires.
- If the answer is a refusal, check whether it gives reasons and mentions the AP and the court.
What should you check as an organisation?
Most complaints to the AP start with a request that was answered late or incompletely. These checks prevent that.
- Do you have a procedure that records each request and its one-month deadline?
- Can you find all data about one person across your systems, including e-mail and back-ups?
- Is each processing operation in your records of processing (Article 30 GDPR) linked to a legal ground?
- Do you know which statutory retention periods apply, such as the seven-year tax retention period?
- Can you report a data breach to the AP within 72 hours?
What can we do for you with data privacy?
We advise individuals and companies on the GDPR as part of our work as IT lawyer.
- We draft your access or erasure request and monitor the one-month deadline.
- We assess a refusal and file a complaint with the AP.
- We file a petition with the district court or an objection against a government body.
- We calculate and claim compensation under Article 82 GDPR.
- We set up a request and data-breach procedure for your organisation.
Summary
- Dutch data privacy law is the GDPR plus the Dutch Implementation Act (UAVG), supervised by the Autoriteit Persoonsgegevens.
- You have rights of access, rectification, erasure, restriction, portability and objection; the organisation must answer within one month.
- An organisation may refuse where it has another legal ground, such as the seven-year tax retention period.
- If your rights are not respected, you can complain to the AP, go to court or claim compensation under Article 82 GDPR.
Frequently asked questions
How long does an organisation have to answer my GDPR request?
One month after receipt. For complex or numerous requests it may extend this by two further months, but it must tell you within the first month (Article 12(3) GDPR).
Can I ask my employer to delete my personnel file?
Only partly. Your employer must keep some data by law, such as wage tax records for seven years, but data that is no longer needed must be deleted on request.
Can I claim compensation for a privacy breach?
Yes, under Article 82 GDPR, for material and non-material damage. You must show that you actually suffered damage; a breach alone is not enough.
Does Dutch privacy law apply to companies outside the EU?
Yes, if they offer goods or services to people in the Netherlands or monitor their behaviour (Article 3(2) GDPR).
