The ABC of the AP: everything about the Dutch Data Protection Authority

The Dutch Data Protection Authority (AP) is the Dutch supervisory body that checks whether companies and the government comply with the GDPR. It does more than just supervise: the AP advises, provides information, handles complaints, conducts investigations, and can impose penalty payments and fines. Failure to comply with privacy rules can be costly. If you disagree with a decision, you can lodge an objection and appeal. Below, you can read what the AP does and what this means for your business.

What is the Dutch Data Protection Authority?

The Data Protection Authority is the Dutch data protection authority. Its statutory task is to assess whether individuals and organizations comply with the General Data Protection Regulation (GDPR), the European basis for privacy protection. The DPA monitors not only companies but also the government itself, ensuring that citizens' privacy is respected everywhere.

What does the AP supervise?

The GDPR stipulates that you may only process personal data that is necessary and for which there is a valid legal basis. Additional protection applies to sensitive information such as medical data, political opinions, and trade union membership. The Dutch Data Protection Authority (AP) monitors compliance with these and other rules — from the legal basis and purpose of processing to security and the rights of data subjects.

The AP does more than supervise

The tasks of the AP are broad:

• Handling complaints regarding compliance with the GDPR;
• Investigate possible violations;
• Enforcement with penalty payments and fines;
• Advising on new legislation and regulations regarding privacy;
• Informing the public and being accountable;
• Cooperate internationally with other supervisory authorities.

What penalties can the AP impose?

Compliance is essential for both businesses and governments. The Dutch Data Protection Authority (AP) can impose penalty payments to stop a violation and fines for breaches of the rules — for example, for failing to report a data breach or the absence of a processing register. The GDPR sets high maximum fines, making compliance financially important as well.

Disagree with a decision by the AP?

If you disagree with a (fine) decision by the AP, you can:

• lodge an objection with the AP itself, usually within six weeks;
• lodge an appeal with the administrative court if the objection is rejected;
• file a complaint with the National Ombudsman regarding the actions of the AP as an administrative body.

Because deadlines are short and the stakes are high, timely legal advice is wise.

Frequently asked questions about the Dutch Data Protection Authority

What should I do if the AP starts an investigation against me?

Take it seriously and respond promptly and carefully. Gather your processing register, legal bases, and security measures, and seek legal assistance. How you communicate during this phase can influence the outcome and any potential sanction.

How do I avoid a fine from the AP?

Ensure a valid legal basis for each processing activity, an up-to-date processing register, a clear privacy statement, appropriate security measures, and a functioning data breach process. A periodic privacy check helps to mitigate risks in a timely manner.

Can a customer report me to the AP?

Yes. Data subjects can file a complaint with the AP if they believe that you are processing their data unlawfully. The AP can investigate that complaint. Proper complaint handling within your organization often prevents it from coming to that point.

Help with privacy and disputes with the AP

The legal experts at MKB Juristen help you understand privacy legislation, implement appropriate measures, and handle an investigation or dispute with the Dutch Data Protection Authority (AP). View our expertise in privacy and data protection or schedule a no-obligation intake.