Տվյալների պաշտպանության օրենսդրությունը Նիդեռլանդներում. GDPR, UAVG և ձեր պարտավորությունները

Data protection law in the Netherlands consists of the General Data Protection Regulation (GDPR), which applies directly, and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, UAVG), which fills in the choices the GDPR leaves to member states. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises compliance and can impose fines; the main exception to the GDPR’s reach is purely personal or household use, such as private photos kept for yourself.

For any organisation, two questions decide most cases: is there a lawful basis for the processing, and does it respect the GDPR’s principles? Below we explain both, the Dutch additions in the UAVG, the rights of individuals, the 72-hour breach notification duty and what an organisation established in the Netherlands needs to have in place.

Which rules apply to personal data in the Netherlands?

The GDPR applies in all EU member states without implementation, and the UAVG adds Dutch rules where the GDPR allows it. Together they apply to companies, government bodies, foundations and anyone else who processes personal data.

Personal data is any information about an identified or identifiable person: a name, an email address, a photo, an IP address or a customer number. Processing covers everything you do with it, from collecting and storing to consulting, sharing and deleting.

The UAVG sets several Dutch-specific rules. Under Article 5 UAVG a child under 16 needs the consent of a parent or legal representative where processing is based on consent. Under Article 46 UAVG the citizen service number (burgerservicenummer, BSN) may only be used where a law prescribes it. Articles 22 to 30 UAVG set the exceptions for special categories of data.

What lawful basis do you need?

Every processing operation needs one of the six lawful bases in Article 6 GDPR: consent, performance of a contract, a legal obligation, vital interests, a public task or a legitimate interest. Consent is only one of them, and often not the right one.

For most commercial and employment processing the correct basis is performance of a contract, a legal obligation or a legitimate interest. Consent must be freely given, specific, informed and withdrawable at any time. Between employer and employee it is rarely free, so relying on it there usually makes the processing unlawful.

A legitimate interest requires a documented balancing test: what is your interest, is the processing necessary for it, and does it outweigh the interests of the people concerned? Record that assessment before you start, not after a complaint.

Which principles must every processing respect?

Article 5 GDPR lists the principles that apply to all processing, whatever the lawful basis. Under the accountability principle you must also be able to show that you comply.

When may you process health data and other special categories?

Only on an exception. Data revealing racial or ethnic origin, political opinions, religion, trade union membership, genetic or biometric data used for identification, health, sex life or sexual orientation may not be processed unless an exception in Article 9 GDPR and the UAVG applies (Article 22 UAVG).

In practice, employers may not register the nature or cause of an employee’s illness; that information belongs with the company doctor. Healthcare providers may process health data for treatment, under the duty of medical confidentiality. Criminal data is subject to similar restrictions under Article 10 GDPR and the UAVG.

What rights do individuals have?

Individuals can ask for access, rectification, erasure, restriction, data portability and can object to processing, under Articles 15 to 22 GDPR. You must answer within one month, a period you can extend by two months for complex requests if you inform the person within the first month (Article 12(3) GDPR).

The right of access is the one most often used, frequently as a first step in an employment or customer dispute. The person is entitled to a copy of the data, the purposes, the recipients and the retention period. Refusing or ignoring a request can lead to a complaint to the AP or an application to the court.

What must you do after a data breach?

Report it to the AP within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the people concerned (Article 33 GDPR). Where the risk is high, you must also inform those people without undue delay (Article 34 GDPR).

A data breach (datalek) is any breach of security leading to loss of, or unauthorised access to, personal data: a lost laptop, an email sent to the wrong recipients, a ransomware attack. Record every breach internally, including those you do not report, with the facts, the effects and the measures taken. Organisations within the scope of the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, may also have to give an early warning of a significant incident within 24 hours.

What does an organisation need to have in place?

Under the accountability principle you must be able to show compliance with documents. The core set is the same for most organisations established in the Netherlands.

• A record of processing activities (Article 30 GDPR), listing purposes, categories of data and recipients, and retention periods.
• A privacy statement that informs people about the processing; see our Հոլանդական օրենսդրության համաձայն՝ գաղտնիության մասին հայտարարությունների վերաբերյալ ուղեցույց.
• Processor agreements with every supplier that processes personal data on your behalf (Article 28 GDPR), such as cloud, payroll and IT providers.
• A data protection impact assessment (DPIA) for processing likely to result in a high risk, such as large-scale monitoring or processing of health data (Article 35 GDPR).
• A data protection officer where your core activities involve large-scale monitoring or large-scale processing of special categories, and always for public authorities (Article 37 GDPR).
• Security measures appropriate to the risk, and a procedure for breaches and for requests from individuals.

What can the Dutch Data Protection Authority do?

The AP can investigate, order you to bring processing into line, impose a processing ban and fine you. Under Article 83 GDPR fines for the most serious infringements reach €20 million or 4% of worldwide annual turnover, whichever is higher.

The AP decides itself which complaints it investigates and it does not award compensation. Individuals who suffered damage claim it in the civil court under Article 82 GDPR. A fine from the AP is an administrative decision: you can object within six weeks and then appeal to the administrative court.

Ի՞նչ պետք է ստուգվի որպես կազմակերպություն։

• Is there a lawful basis under Article 6 GDPR for each processing purpose, and is it documented?
• Is your record of processing activities complete and current?
• Do you have a processor agreement with every supplier that handles personal data for you?
• Can you answer access and erasure requests within one month?
• Do you have a breach procedure that allows notification to the AP within 72 hours?
• Do you use the BSN only where a law prescribes it (Article 46 UAVG)?

Ի՞նչ պետք է ստուգել որպես անհատ։

• Read the organisation’s privacy statement to see on what basis and for what purpose it uses your data.
• Send a written access request under Article 15 GDPR and note the date; the answer is due within one month.
• Withdraw consent or object where the processing is based on consent or a legitimate interest.
• Keep copies of all correspondence in case you complain to the AP or go to court.
• If you suffered damage, consider a claim under Article 82 GDPR in the civil court.

What can we do for you with data protection?

մեր ՏՏ և գաղտնիության իրավունքի փաստաբաններ advise organisations and individuals on the GDPR and the UAVG:

• We review your processing activities and set up or check your record of processing.
• We draft privacy statements, processor agreements and data protection policies.
• We carry out or review a DPIA for high-risk processing.
• We advise within the 72-hour window after a data breach on notification to the AP and to individuals.
• We handle access and erasure requests and complaints, for organisations and individuals.
• We object to AP decisions and fines and conduct the appeal.

Ամփոփում

• The GDPR applies directly in the Netherlands; the UAVG adds Dutch rules, such as the age of 16 for consent and limits on use of the BSN.
• Every processing needs a lawful basis under Article 6 GDPR; consent is often not the right one, especially at work.
• Special categories such as health data may only be processed under an exception.
• Requests from individuals must be answered within one month; breaches must be reported to the AP within 72 hours.
• The AP can impose fines of up to €20 million or 4% of worldwide annual turnover.

Հաճախակի տրվող հարցեր