DBA Act: do I need to use a model agreement?
The DBA Act replaced the VAR: the client and the contractor now jointly assess whether there is a case of self-employment or (disguised) employment. Using a model agreement is not mandatory, but can...
Knowledge base for entrepreneurs
Privacy
Read legal articles, practical tips, and current developments for entrepreneurs and organizations.
Articles about Privacy
Practical legal information for entrepreneurs. Read what to look out for, which steps are sensible, and when legal advice is necessary.
The controller must inform other controllers of a request for data erasure
If you receive a request to erase personal data (the right to be forgotten, Article 17 GDPR) and you have shared that data with other controllers, you must take reasonable measures...
Hospital must pay damages due to GDPR breach
A GDPR breach can cost you more than a fine from the Dutch Data Protection Authority. In addition, data subjects can claim compensation themselves (Article 82 GDPR), including for non-material damage. A hospital that the...
Information from which sensitive data can be derived is also sensitive
You may only process special categories of personal data, such as health or sexual orientation, under strict conditions. The European Court of Justice has confirmed that data from which such special categories of data can indirectly...
Rules for the processing of personal data by video platforms
If you start your own video platform — for example, to broadcast competitions, recordings, or corporate videos — you process personal data and must comply with the GDPR. Think of account details...
The privacy statement is especially important when applying via video
When applying via video, you process more and more sensitive personal data than with a regular letter — images, sound, and non-verbal behavior. A clear privacy statement is therefore especially important: inform candidates in advance what...
Sports clubs and personal data: important to do it right
Sports clubs process a significant amount of personal data from members and volunteers and must therefore comply with the GDPR. Important: do not retain data longer than necessary — especially that of departing members — process...
The Dutch Data Protection Authority already imposed these 3 massive fines in 2022
The Dutch Data Protection Authority (AP) actively enforces the GDPR and issues hefty fines to both government bodies and businesses. Those fines prove one thing: ensure your privacy matters are in order,...
Is my website allowed to place cookies without permission?
Your website may not simply place cookies without permission. For most cookies — especially tracking and marketing cookies — you must first inform the visitor and ask for consent. Only functional...
Limits to the right of access: food for discussion
The right of access under the GDPR gives data subjects the right to see which personal data you process about them (Article 15 GDPR). However, that right is not limitless: it only covers...
- We worked for, among others:
