Netherlands

Territorial scope for privacy comes from Article 3 of the General Data Protection Regulation. The Dutch national top-up law, the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), adds Dutch-specific choices but not a separate scope test. The representative duty for non-EU digital infrastructure firms is Article 42 of the Cyberbeveiligingswet, in force since 15 August 2026; where such an entity has appointed no representative in any member state where it offers services, it must appoint one. Note the Dutch cybersecurity law also applies to public bodies and, with a long lead time, to higher education institutions.

Sector by sector, checked 18 August 2026. ONLINE GAMBLING — closed. The Remote Gambling Decree says the gaming system may sit in any member state, but by way of derogation the control database goes in the Netherlands. A companion ministerial regulation adds that it may not be placed anywhere Dutch inspectors cannot get immediate physical access to. CENTRAL GOVERNMENT — closed outside Europe. The revised government-wide cloud policy of 3 July 2026 states flatly that storage and processing take place within the European Economic Area and Switzerland. Email and documents may not go into public cloud at all unless three conditions are met and a minister signs off. Vital and essential entities are advised not to use suppliers under non-EU jurisdiction for core processes. Existing arrangements have a four-year transition. HEALTH — conditional, no localisation found. Dutch law makes the national security standards NEN 7510 and NEN 7512 and the access-logging standard NEN 7513 legally binding on care providers running electronic exchange systems, and medical secrecy is criminally enforced, but no rule requiring Dutch or European storage was found, checked 18 August 2026. BANKING, PAYMENTS, INSURANCE, SECURITIES — conditional, no localisation found. Dutch prudential rules forbid outsourcing that would obstruct proper supervision, and the EU digital operational resilience rules govern the rest. No storage-location rule was found, checked 18 August 2026. TELECOM — conditional. The retention duty in the Telecommunications Act is unenforceable (see the traps answer) and contains no location requirement. EDUCATION, GAMING OTHER THAN GAMBLING, E-COMMERCE, MAPPING AND LOCATION DATA — no localisation rule found, checked 18 August 2026. Confidence medium on mapping, because we searched the statute book rather than every licence condition. DEFENCE — the Ministry of Defence is carved out of the government cloud policy entirely and runs a stricter regime we could not open.

Approved destinations as at 18 August 2026 are Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, the European Patent Organisation, and the United States only for organisations self-certified under the EU-US Data Privacy Framework. The 2021 Standard Contractual Clauses remain the operative set and have not been amended; the promised new clauses for importers already directly caught by European privacy law are still not adopted. A transfer impact assessment is still expected. The Dutch regulator has made clear it treats a missing transfer instrument as a very serious breach, not a technicality: it fined Uber 290 million euros (about 315 million dollars) in 2024 for two years of transfers to the United States with no instrument at all, and fined a taxi app 100 million euros (about 109 million dollars) in May 2026 for sending driver and customer data to Russia. Both were transfer cases, not security cases.

The privacy regulator is the Autoriteit Persoonsgegevens. Board as at 18 August 2026: Geert Potjewijd, chair since 1 August 2026, appointed for five years; Monique Verdier, deputy chair; Katja Mur, member. The regulator's 2025 annual report, published 2 April 2026, describes a deliberate shift toward faster settlements and interventions alongside formal sanctions, focused on algorithms and artificial intelligence, big tech, data trading and digital government. Its published sanction toolkit runs from warnings and reprimands through orders subject to a penalty payment to processing bans and fines up to 20 million euros or four percent of worldwide turnover. Rate: aggressive. Under the new Cyberbeveiligingswet the supervisors are the responsible sector ministries, with the national cyber security centre acting as the computer security incident response team. A designation of supervisors and delegation of powers by the Ministry of the Interior was published on 14 August 2026, one day before the law took effect, so this enforcement track is best rated as waking rather than active. Other live regulators: the Netherlands Authority for Consumers and Markets for telecom and cookie rules, the Dutch Central Bank and the Authority for the Financial Markets for finance, the Netherlands Gambling Authority for online gambling, and the Health and Youth Care Inspectorate for care providers.

The floors we verified in the statutes on 18 August 2026: company books and records, seven years, plus seven years after a company is dissolved; tax administration, seven years; anti-money-laundering customer and transaction records, five years from the end of the business relationship or from the transaction; online gambling system change records, at least five years. Cybersecurity incident data held by the national response team is capped, not floored: some categories must be deleted within twelve months and others within sixty months. Care providers must log every access to an electronic patient record to a national standard, and retention periods for those logs are set by sector bodies rather than by the decree itself, which is a common source of confusion. There is no general Dutch deletion deadline. The ceiling is the European storage-limitation principle plus the right to erasure. The practical rule is that a specific statutory retention duty is a lawful reason to keep the record for exactly that period and no longer.

The 72-hour privacy clock runs from the moment you become aware of the breach and comes from European law. The cybersecurity clocks come from the Cyberbeveiligingswet and apply to essential and important entities across energy, transport, banking, health, water, digital infrastructure, public administration, post, waste, chemicals, food, manufacturing, digital providers and research. The early warning must say whether the incident looks malicious and whether it may have cross-border effects, and must name the responsible contact. If the incident is still running when the final report is due, you file a progress report instead and the final report follows within one month of resolution. You also have to warn the users of your service where the incident may affect them. The fourth clock is Article 11.3a of the Telecommunications Act: a provider of a public electronic communications service must notify the privacy regulator of a security breach affecting personal data without delay, and must tell affected individuals where the breach is likely to harm their privacy. Financial firms have a fifth set of deadlines under the European digital operational resilience rules. The overlap is the failure point. A ransomware hit on a hospital or a cloud provider triggers the 24-hour cyber alarm and the 72-hour privacy notification at once, and they go to different authorities.

1. WORKS COUNCIL VETO. Under the Works Councils Act the employer needs the works council's consent before adopting, changing or withdrawing any rule on processing and protecting staff personal data, and any facility designed to observe or check the presence, conduct or performance of staff. That covers HR systems, access control, camera schemes, keystroke or productivity monitoring and most artificial-intelligence tools aimed at employees. Without consent the decision can be voided. This is a Dutch trap because it is employment law, not privacy law, so privacy counsel routinely miss it. 2. CRIMINAL LIABILITY. Deliberately breaking a duty of secrecy arising from an office, profession or statute is a criminal offence under the Dutch Criminal Code, punishable by up to one year in prison or a fifth-category fine, which since 1 January 2026 is 110,000 euros (about 120,000 dollars). The sentence is increased by one third if the act was committed for a foreign power. This bites on doctors, lawyers, notaries and tax advisers, and it attaches to individuals rather than to companies. 3. A LAW THAT LOOKS BINDING AND IS NOT. Article 13.2a of the Telecommunications Act still says operators must retain telephone traffic data for twelve months and internet data for six months. The Hague District Court suspended the underlying Data Retention Act on 11 March 2015 and it has never been repealed or replaced. A naive reading of the statute book gets this wrong. 4. AGE SIXTEEN. The Dutch implementation act keeps the age of digital consent at sixteen, the top of the European range. Below that, a legal representative must consent, and that consent can be withdrawn at any time. 5. PHASED CYBERSECURITY DUTIES. The Cyberbeveiligingswet took effect on 15 August 2026, but the duty of care and the governance duty only apply to designated higher education institutions from 36 months after designation. Separately, one part of the September 2026 privacy amendment act has been deliberately left uncommenced.

DATED ITEMS. 1 September 2026 — the Verzamelwet gegevensbescherming, the Act of 9 June 2026 amending the Dutch privacy implementation act, comes into force, except one part which the commencement decree of 9 July 2026 expressly holds back. It adds exemptions for statutory audit engagements, two new provisions on transferring health files by care providers and by others, a rule for temporary commissions and advisory boards, and transitional provisions. 15 August 2026 — the Cyberbeveiligingswet and its implementing decree took effect, repealing the older network and information systems security law. The national register of entities must be up within one month of the register provision starting. The Critical Entities Resilience Act was enacted the same day. 12 January 2027 — under the European Data Act all cloud switching charges and data egress fees must be zero. DORMANT SWITCHES, which matter more than pending bills. The government cloud policy is ministerial policy, not statute, so its scope, its four-year transition and its exceptions can be tightened at any moment without consultation; Parliament has already asked for at least 30 percent of central government cloud storage and applications to come from Dutch or European soil by 2029, and the policy says it will be rewritten once a sovereign government cloud exists. The telecom retention articles remain printed in the Telecommunications Act. A new act or a successful appeal could make them live again without any new parliamentary vote on the text itself. The cybersecurity law lets ministers designate additional essential and important entities by decision, which can pull a company into 24-hour incident reporting overnight. At European level, the letter the European Data Protection Board sent to the Commission on 31 July 2026 asking it to re-examine the EU-US Data Privacy Framework is the single biggest external risk to any Dutch business relying on that framework alone.