Netherlands Implementation Act GDPR

Why does it matter?

A Dutch employer that keeps sick-leave records, a retailer that signs up a 14-year-old or a bank that checks identity with biometrics cannot answer those questions from the GDPR text alone. The UAVG gives the Dutch answer, and the AP enforces it together with the GDPR through fines of up to the amounts in Article 83(4) to (6) of the GDPR (UAVG Article 14(3)).

Key benefits include:

• Minors have set rules

Article 5 requires the legal representative's consent where the data subject is under 16; a child of 12 to 15 may exercise rights alongside the representative, and a person of 16 or older may go to court alone (Article 5(4) and (5)).

• Special-category exceptions are listed

Articles 22 to 30 spell out who may process health, genetic, biometric and similar data; for example Article 30(1) lets employers process health data for re-integration of employees on sick leave.

• One regulator with fining power

The AP is the supervisory authority (Article 6(2)) and may fine under Article 14(3), also public bodies (Article 18), and may fine up to EUR 20,000,000 or 4% of worldwide turnover for criminal-data breaches (Article 17).

• Sanction decisions become public

Under Article 21b, in force since September 1, 2026, the AP publishes sanction decisions after ten working days, unless public-access exceptions apply or interim relief is requested.

• Clear route to challenge

A written reply to a request under GDPR Articles 15 to 22 must meet the Article 12(3) deadlines (Article 34); against a private controller the person can petition the district court within six weeks (Article 35).

How does it work?

The UAVG is the 'execution act' for an EU regulation. Because the GDPR applies directly, the UAVG adds only what the GDPR allows or requires a member state to decide: who supervises, how minors consent, which special-category processing is lawful in Dutch law, which rights may be restricted and how decisions are appealed. Article 2 applies the Act to wholly or partly automated processing and to filed personal data, and excludes processing governed by the Wet basisregistratie personen or the Kieswet.

Article 3 extends the Act, with the GDPR applying by analogy, to processing outside EU law and to armed forces' activities under the EU's common foreign and security policy (Title V, Chapter 2 TEU), but not to the intelligence services, which fall under the Wet op de inlichtingen- en veiligheidsdiensten 2017. Article 4 sets territorial reach. Article 2a obliges the AP to take the needs of micro, small and medium-sized enterprises into account when applying the GDPR.

The AP supervises with the powers of Articles 14 to 16: administrative fines, orders subject to administrative enforcement (last onder bestuursdwang) and entry into dwellings without the occupant's consent on express authorization. A fine is suspended while the objection or appeal period runs (Article 38).

Key Elements

• Minors and representation (Article 5)

Consent of the legal representative below age 16; rights exercised by the representative below 12; consent can be withdrawn by the representative and by a data subject aged 12 or older.

• Autoriteit Persoonsgegevens (Articles 6 to 21b)

Legal personality, a chair and two other members, an advisory council, fines, penalty orders and, since September 1, 2026, publication of sanction decisions.

• Special categories (Articles 22 to 30b)

Exceptions for racial or ethnic data, political views, religious belief, genetic data (Article 28), biometric authentication (Article 29), health data (Articles 30 to 30b).

• Criminal-offense data (Articles 31 to 33)

Processing allowed only on the grounds of Articles 32 and 33, for example for a contract decision or to protect the controller's interests against offenses.

• Restrictions and exemptions (Articles 40 to 47)

Automated decisions (40), restrictions on GDPR Articles 12 to 21 and 34 (41), journalism and artistic expression (43), research and statistics (44), archiving (45).

• National identification number (Article 46)

A number prescribed by law to identify a person, such as the citizen service number (BSN, regulated by the Wet algemene bepalingen burgerservicenummer), may be used only to carry out the law concerned or for purposes the law sets.

What does it cover?

The UAVG covers personal data processing by controllers and processors established in the Netherlands, in the private and the public sector, and by non-EU organizations that target people in the Netherlands (Article 4). It does not cover processing under the Wet basisregistratie personen or the Kieswet (Article 2(2)), nor processing by the intelligence services (Article 3(3)(b)). Law enforcement data is handled under separate Dutch statutes such as the Wet politiegegevens, which Article 33(1)(a) references.

What are its objectives?

The UAVG exists to execute the GDPR in Dutch law and to give the AP the means to enforce it.

Designate the AP as the supervisory authority under GDPR Article 51(1) and give it fining, enforcement and publication powers.

Set Dutch rules for the consent and representation of minors and incapacitated adults.

Define the Dutch exceptions to the ban on special categories and criminal-offense data.

Restrict data subject rights only for the listed public interests, necessary and proportionate (Article 41).

Give data subjects a route to a decision, an appeal or a court request (Articles 34 to 38).

Framework in Context

The UAVG sits between the GDPR above it and Dutch sector law beside it. Its predecessor, the Wet bescherming persoonsgegevens, was withdrawn by Article 51. Article 50 requires the Minister to report to the Staten-Generaal on the Act's effects within three years of commencement and every four years after that. Organizations pair it with the GDPR itself, whose Article 33 sets the 72-hour breach notice, and with the Dutch rules on the BSN. Article 42 exempts financial undertakings under the Wet op het financieel toezicht from notifying data subjects of a breach under GDPR Article 34.

Common Framework Mappings

Organizations map the UAVG together with the GDPR and neighboring privacy laws so that one set of records and controls serves each regime.

Mapped frameworks include:

CCPA/CPRA

ePrivacy Directive (2002/58/EC)

GDPR

ISO 27701

NIST Privacy Framework v1.0

Swiss FADP (SR 235.1)

UK DPA 2018