AP urges transparent and clear privacy policy

A privacy policy is mandatory under the GDPR: it explains clearly and accessibly how your company collects, uses, shares, and protects personal data, and what rights data subjects have. The Dutch Data Protection Authority (AP) insists on greater transparency, and if a good privacy policy is lacking, you risk a fine. But transparency is also an opportunity: it builds trust with customers and partners. Below, you can read what belongs in a privacy policy and what the AP looks for.

What is a privacy policy?

A privacy policy isthe document in which you explain how your organization collects, uses, shares, and protects personal data. Drafting one is a legal obligation under the General Data Protection Regulation (GDPR). At the same time, it is a way to demonstrate that you handle data with care. A good privacy policy is clear, accessible, and understandable to everyone — not an unreadable legal document.

Why does the AP insist on transparency?

The Dutch Data Protection Authority observes that many organizations are unclear about what they do with personal data. Transparency is not only a legal requirement but also part of responsible business practice. Customers are becoming increasingly aware of their digital footprint; by being open, you build trust and strengthen your reputation.

The AP may actually classify an unclear or misleading privacy policy as a violation. That a flawed policy can be costly is evident from previous enforcement, such as the fine imposed on TikTok for an unclear privacy policy and previous AP fines.

What should be included in a privacy policy?

Under the GDPR, your privacy policy must in any case make clear:

• Which data you collect and for what purpose.
• On what basis you do so (such as consent, a contract, or a legitimate interest).
• How long you retain the data and how you secure it.
• With whom you share data and under what circumstances (for example, processors or third parties).
• Which rights data subjects have, such as the right to access, correction, and deletion.
• How to make contact or file a complaint.

Transparency regarding cookies and other tracking technologies is also mandatory. You often document this in a separate cookie policy or cookie statement. For the placement of non-essential cookies and for processing based on consent, you must request explicit consent in advance, unless you have another valid legal basis.

Frequently asked questions about the privacy policy

Is a privacy policy mandatory for every company?

As soon as you process personal data — and virtually every company does, think of customer and employee data — you must inform the data subjects about what you do with their data. An accessible privacy policy is the best way to comply with this duty to inform. The size of your company does not matter for this obligation.

What is the difference between a privacy policy and a privacy statement?

The terms are often used interchangeably. A privacy statement usually refers to the external explanation for customers and website visitors. A privacy policy can be broader and also include internal agreements on how your organization handles data. It is important that the external explanation aligns with what you actually do internally.

Can I use a standard privacy policy from the internet?

A template is at most a starting point. A privacy policy must accurately describe your own processing activities; a copied document that does not align with practice is precisely a risk. The Dutch Data Protection Authority (AP) pays particular attention to ensuring that the policy is both clear and correct.

Have a privacy policy drafted or reviewed

Data processing regulations are complex, and privacy legislation is constantly changing. A legally sound and up-to-date privacy policy reduces the risk of violations and fines. The legal experts at MKB Juristen draft a compliant privacy policy for you or review your existing policy. Schedule a no-obligation intake and ensure you comply with the GDPR.