Netherlands
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) | Wet van 16 mei 2018, Stb. 2018, 144, as amended | In force | 25 May 2018 |
| Telecommunicatiewet | Wet van 19 oktober 1998, Stb. 1998, 610, as amended | In force | 15 December 1998 |
| Verzamelwet gegevensbescherming | Wet van 10 juni 2026, Stb. 2026, 154 (Kamerstukken 36264) | In force | 1 September 2026 |
| Uitvoeringswet AI-verordening (bill) | Draft bill, public consultation opened 20 April 2026 | Draft, not law | — |
- Uitvoeringswet Algemene verordening gegevensbescherming (UAVG): The Dutch act that implements the GDPR. The Verzamelwet gegevensbescherming changed it from 1 September 2026.
- Telecommunicatiewet: Article 11.7a covers cookies and similar technologies, article 11.7 covers spam and telemarketing, and article 11.3a covers breach notices by telecoms providers. Since 1 July 2026 an amendment made through the Energiewet (Kamerstukken 36378), together with a 2025 repair act (Kamerstukken 36776), removed the existing-customer exception for telemarketing calls.
- Verzamelwet gegevensbescherming: Amends the UAVG and other laws. In force from 1 September 2026 (decree in Stb. 2026, 196), except a new UAVG exception for statutory audits (Article I, part I), which waits for a follow-up bill.
- Uitvoeringswet AI-verordening (bill): Would set up national supervision under the EU AI Act, with the RDI and the AP as coordinating supervisors working with sector supervisors, and the RDI as single point of contact. As far as we could check, it wasn’t law by 5 November 2026.
Regulators
Section titled “Regulators”- Autoriteit Persoonsgegevens (AP), the data protection authority and coordinating supervisor for algorithms and AI
- Autoriteit Consument & Markt (ACM), for the cookie, spam and telemarketing rules in the Telecommunicatiewet
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR applies directly, and the UAVG implements it. The UAVG covers processing in the context of a Dutch establishment, and processing by organisations outside the EU that offer goods or services to people in the Netherlands or monitor their behaviour there (art. 4). It also applies the GDPR’s rules to some activities outside EU law (art. 3).
Sources: wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=1&artikel=4 · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=1&artikel=3 · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Lawful bases
Section titled “Lawful bases”The GDPR’s six lawful bases apply. The UAVG adds national exceptions for special category and criminal offence data (arts. 22 to 33). A number that a law prescribes to identify people, such as the BSN, may only be used where that law allows (art. 46). Since 1 September 2026, the national exception for biometric identification covers only authentication or security needs, and only as far as a compelling public interest in controlled access requires (art. 29).
Sources: wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=3¶graaf=3.1&art… · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=3¶graaf=3.1&art… · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=46 · zoek.officielebekendmakingen.nl/stb-2026-196.html
Consent age for online services
Section titled “Consent age for online services”The Netherlands kept the GDPR default. When an online service offered directly to a child relies on consent, children can consent for themselves from 16. Below that, a parent or other legal representative must consent. Dutch law applies the same age of 16 to consent in other settings too (art. 5 UAVG).
Sources: wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=1&artikel=5 · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Children
Section titled “Children”Since 1 September 2026, children aged 12 or over can withdraw a consent themselves, and those aged 12 to 15 can use their GDPR rights alongside their parents. Parents act for children under 12. From 16, a minor can go to court alone over their GDPR rights. The parental consent rules don’t apply to free help and advice services offered directly to minors (art. 5 UAVG).
Sources: wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=1&artikel=5 · wetten.overheid.nl/BWBR0040940/2026-09-01/0/Hoofdstuk1/Artikel5/infor…
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a device needs consent after clear and full information (art. 11.7a Telecommunicatiewet). Consent isn’t needed when it’s only to carry a communication, strictly necessary for a service the user asked for, or for analytics on a service’s quality or effectiveness with little or no privacy impact. Tracking across services is presumed to involve personal data. Public bodies may never make access depend on consent. The ACM enforces the cookie rule and the AP the personal data processing. The AP says cookie walls aren’t allowed.
Sources: wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=11¶graaf=11.1&a… · wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=15¶graaf=15.1&a… · autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/co…
Electronic marketing
Section titled “Electronic marketing”Commercial, ideological or charitable electronic messages, automated calls and faxes need prior consent (art. 11.7 Telecommunicatiewet). The soft opt-in covers messages to customers about your similar products, with an opt-out at collection and in each message. Since 1 July 2026, telemarketing calls to individuals need consent, existing customers included; only charities, some lotteries and periodical publishers have limited exceptions. Businesses, and people contacted in their work, need no consent at contact details they made known for such messages (art. 11.7(3)). The ACM enforces.
Sources: wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=11¶graaf=11.1&a… · wetten.overheid.nl/BWBR0009950/2026-08-15/0/Hoofdstuk11/Paragraaf11.1… · acm.nl/nl/verkoop-aan-consumenten/reclame-en-verleiden/verkoop-telema… · acm.nl/nl/verkoop-aan-consumenten/reclame-en-verleiden/spam-voorkomen…
Breach notification
Section titled “Breach notification”The GDPR rule applies. Report a breach to the AP without undue delay and, where feasible, within 72 hours, unless it’s unlikely to risk people’s rights, and tell affected people without undue delay when the risk to them is high. Financial firms under the Wft don’t have to notify affected people under Art. 34 GDPR (art. 42 UAVG). Public telecoms and internet providers must also notify the AP without delay (art. 11.3a Telecommunicatiewet), within 24 hours of detection where feasible (Regulation 611/2013), and tell those affected when their privacy is likely to suffer.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=42 · autoriteitpersoonsgegevens.nl/en/themes/security/data-breaches · wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=11¶graaf=11.1&a… · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Registration and fees
Section titled “Registration and fees”There’s no registration and no fee. If you have a data protection officer, publish their contact details and send them to the AP (Art. 37(7) GDPR).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML
Data protection officer
Section titled “Data protection officer”The GDPR rule applies, with no extra national cases. Appoint a DPO if you’re a public authority, or if your core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal offence data. The UAVG adds a duty of confidentiality for the DPO about complaints and requests (art. 39).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=3¶graaf=3.4&art…
International transfers
Section titled “International transfers”The GDPR rules apply. Transfers outside the EEA need an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a listed exception. The UAVG adds no transfer rules for businesses.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · wetten.overheid.nl/BWBR0040940
Impact assessments
Section titled “Impact assessments”Carry out a DPIA before high-risk processing (Art. 35 GDPR). The AP’s list (November 2019) names 17 types that need one, most only when large-scale or systematic, such as fraud detection, credit scoring, camera surveillance, employee monitoring, and location, health or biometric data. Three apply on other conditions, namely blacklists shared with third parties, sensitive data shared in partnerships with public bodies, and systematic, extensive profiling. The list isn’t exhaustive, so other high-risk processing can need a DPIA too.
Sources: zoek.officielebekendmakingen.nl/stcrt-2019-64418.html
Automated decisions and AI
Section titled “Automated decisions and AI”Art. 22 GDPR applies. The UAVG lifts the ban for automated decisions not based on profiling when needed for a legal obligation or a public-interest task, with safeguards; for controllers that aren’t public bodies, these include human intervention and the right to give one’s view and to contest (art. 40). The EU AI Act applies directly, but by 5 November 2026 the Netherlands still hadn’t set its AI Act supervisors or penalties in law, due by 2 August 2025. A draft bill consulted on from 20 April 2026 would make the RDI the single point of contact, coordinating with the AP.
Sources: wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=40 · autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/eu-ai-act · rdi.nl/actueel/nieuws/2026/04/20/toezicht-ai-balans-veiligheid-en-inn… · zoek.officielebekendmakingen.nl/kst-22112-4318.pdf · ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implemen…
Penalties
Section titled “Penalties”GDPR fines apply, up to €20 million or 4% of worldwide annual turnover, and the AP may also fine public bodies (art. 18 UAVG). The AP sets GDPR fines with the EDPB’s guidelines, and its 2023 fining policy covers other cases. Since 1 September 2026 it must publish its sanction decisions (art. 21b UAVG). The ACM can fine cookie, spam and telemarketing breaches up to €900,000 or 1% of turnover, doubled for a repeat offence within five years.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=2¶graaf=2.2&art… · wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=2¶graaf=2.2&art… · wetten.overheid.nl/jci1.3:c:BWBR0049034 · wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=15¶graaf=15.2&a…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/nl.yaml.