Netherlands

Who the privacy rules cover comes from Article 3 of the General Data Protection Regulation. The Dutch national top-up law is the Uitvoeringswet Algemene verordening gegevensbescherming, or UAVG. It adds Dutch-specific choices. It does not change who is covered. The duty to appoint a representative comes from Article 42 of the Cyberbeveiligingswet, the Dutch cybersecurity law. That law has applied since 15 August 2026. If a company from outside the European Union has appointed no representative in any member state where it offers services, it must appoint one. The Dutch cybersecurity law also covers public bodies. It covers higher education institutions too, but only after a long lead time.

Sector by sector, checked 18 August 2026. ONLINE GAMBLING. Closed. The Remote Gambling Decree says the gaming system may sit in any member state. But the control database must go in the Netherlands. A companion ministerial regulation adds that it may not sit anywhere Dutch inspectors cannot reach immediately in person. CENTRAL GOVERNMENT. Closed outside Europe. The revised government-wide cloud policy of 3 July 2026 says storage and use of data must happen within the European Economic Area and Switzerland. Email and documents may not go into public cloud at all. The only way around that is to meet three conditions and get a minister to sign off. Vital and essential bodies are advised not to use suppliers under non-EU jurisdiction for core work. Existing arrangements have four years to change. HEALTH. Conditional. We found no rule saying data must stay in the Netherlands or Europe, checked 18 August 2026. Dutch law does make the national security standards NEN 7510 and NEN 7512 legally binding on care providers running electronic exchange systems. It does the same for the access-logging standard NEN 7513. Breaking medical secrecy is a crime. BANKING, PAYMENTS, INSURANCE, SECURITIES. Conditional. We found no rule about where data must sit. Dutch banking supervision rules forbid outsourcing that would block proper supervision. The EU digital operational resilience rules cover the rest. TELECOM. Conditional. The duty to keep telecom data cannot be enforced. See the traps answer. It says nothing about where data must sit. EDUCATION, GAMING OTHER THAN GAMBLING, E-COMMERCE, MAPPING AND LOCATION DATA. We found no rule about where data must sit, checked 18 August 2026. Confidence is medium on mapping, because we searched the statute book rather than every licence condition. DEFENCE. The Ministry of Defence is left out of the government cloud policy entirely. It runs stricter rules that we could not open.

Approved destinations as at 18 August 2026 are Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay and the European Patent Organisation. The United States counts only for organisations self-certified under the EU-US Data Privacy Framework. The 2021 Standard Contractual Clauses are still the set to use, and they have not been amended. Europe promised extra clauses for receivers already covered directly by European privacy law. Those are still not adopted. You are still expected to write down why the destination country is safe. The Dutch regulator treats missing transfer paperwork as a very serious breach, not a technicality. It fined Uber 290 million euros (about 315 million dollars) in 2024. Uber had sent data to the United States for two years with no paperwork at all. It fined a taxi app 100 million euros (about 109 million dollars) in May 2026 for sending driver and customer data to Russia. Both cases were about sending data abroad, not about security.

The privacy regulator is the Autoriteit Persoonsgegevens. Its board as at 18 August 2026: Geert Potjewijd, chair since 1 August 2026, appointed for five years; Monique Verdier, deputy chair; Katja Mur, member. Its 2025 annual report was published on 2 April 2026. It describes a deliberate shift toward faster settlements and interventions alongside formal sanctions. The focus is algorithms and artificial intelligence, big tech, data trading and digital government. Its published toolkit starts with warnings and reprimands. Next come orders backed by a penalty payment, then bans on using data. At the top are fines up to 20 million euros, or four percent of worldwide turnover. Rate: aggressive. Under the new Cyberbeveiligingswet the supervisors are the responsible sector ministries. The national cyber security centre acts as the computer security incident response team. The Ministry of the Interior published a designation of supervisors and delegation of powers on 14 August 2026. That was one day before the law took effect, so this enforcement track is only starting up. Other live regulators. The Netherlands Authority for Consumers and Markets handles telecom and cookie rules. The Dutch Central Bank and the Authority for the Financial Markets handle finance. The Netherlands Gambling Authority handles online gambling. The Health and Youth Care Inspectorate handles care providers.

Here are the minimum keeping periods we verified in the statutes on 18 August 2026. Company books and records: seven years, plus seven years after a company is dissolved. Tax records: seven years. Anti-money-laundering customer and transaction records: five years from the end of the business relationship or from the transaction. Online gambling system change records: at least five years. Cybersecurity incident data held by the national response team works the other way round. It has a maximum, not a minimum. Some categories must be deleted within twelve months and others within sixty months. Care providers must log every access to an electronic patient record to a national standard. Sector bodies set how long those logs are kept, not the decree itself. This is a common source of confusion. There is no general Dutch deadline to delete. The ceiling is the European rule that you keep data no longer than you need it, plus the right to erasure. So a specific legal duty to keep a record lets you keep it for exactly that period and no longer.

The 72-hour privacy clock starts the moment you become aware of the breach. It comes from European law. The cybersecurity clocks come from the Cyberbeveiligingswet. They apply to essential and important bodies across energy, transport, banking, health, water, digital infrastructure, public administration, post, waste, chemicals, food, manufacturing, digital providers and research. The early warning must say whether the incident looks malicious. It must say whether it may have effects in other countries. It must name the responsible contact. If the incident is still running when the final report is due, you file a progress report instead. The final report then follows within one month of the incident being resolved. You must also warn the users of your service where the incident may affect them. The fourth clock is Article 11.3a of the Telecommunications Act. A provider of a public electronic communications service must tell the privacy regulator without delay about a security breach affecting personal data. It must also tell affected people where the breach is likely to harm their privacy. Financial firms have a fifth set of deadlines under the European digital operational resilience rules. The overlap is where things go wrong. A ransomware attack on a hospital or a cloud provider starts the 24-hour cyber clock and the 72-hour privacy clock at the same time. They go to different authorities.

1. WORKS COUNCIL VETO. Under the Works Councils Act you need the works council's consent for rules about staff personal data. That covers adopting, changing or withdrawing any rule on how staff data is used and protected. You also need consent for any system built to watch or check the presence, conduct or performance of staff. That covers HR systems, access control, camera schemes, keystroke or productivity monitoring, and most artificial intelligence tools aimed at employees. Without consent the decision can be voided. This is a Dutch trap because it is employment law, not privacy law, so privacy lawyers routinely miss it. 2. CRIMINAL LIABILITY. Deliberately breaking a duty of secrecy that comes from an office, profession or statute is a crime under the Dutch Criminal Code. The penalty is up to one year in prison, or a fifth-category fine. Since 1 January 2026 that fine is 110,000 euros (about 120,000 dollars). The sentence goes up by one third if the act was done for a foreign power. This applies to doctors, lawyers, notaries and tax advisers. It attaches to people, not to companies. 3. A LAW THAT LOOKS BINDING AND IS NOT. Article 13.2a of the Telecommunications Act still says operators must keep telephone traffic data for twelve months and internet data for six months. The Hague District Court suspended the underlying Data Retention Act on 11 March 2015. It has never been repealed or replaced. Reading the statute book alone gets this wrong. 4. AGE SIXTEEN. The Dutch implementation act sets the age of digital consent at sixteen, the top of the European range. Below that age a legal representative must consent. That consent can be withdrawn at any time. 5. PHASED CYBERSECURITY DUTIES. The Cyberbeveiligingswet took effect on 15 August 2026. But the duty of care and the governance duty only apply to designated higher education institutions 36 months after they are designated. Separately, one part of the September 2026 privacy amendment act has deliberately been left switched off.

DATED ITEMS. 1 September 2026. The Verzamelwet gegevensbescherming comes into force. This is the Act of 9 June 2026 that amends the Dutch privacy implementation act. One part is held back by the commencement decree of 9 July 2026. The act adds exemptions for statutory audit work. It adds two new rules on handing over health files, one for care providers and one for others. It adds a rule for temporary commissions and advisory boards, plus transitional rules. 15 August 2026. The Cyberbeveiligingswet and its implementing decree took effect. They repealed the older network and information systems security law. The national register of bodies must be up within one month of the register rule starting. The Critical Entities Resilience Act was enacted the same day. 12 January 2027. Under the European Data Act all cloud switching charges and data export fees must be zero. POWERS THAT CAN BE USED WITHOUT WARNING. These matter more than pending bills. The government cloud policy is ministerial policy, not law. Its scope, its four-year transition and its exceptions can be tightened at any moment without consultation. Parliament has already asked for at least 30 percent of central government cloud storage and applications to come from Dutch or European soil by 2029. The policy says it will be rewritten once a sovereign government cloud exists. The telecom retention articles are still printed in the Telecommunications Act. A new act or a successful appeal could make them live again, with no new parliamentary vote on the text itself. The cybersecurity law lets ministers name extra essential and important bodies by decision. That can pull a company into 24-hour incident reporting overnight. At European level, the European Data Protection Board wrote to the Commission on 31 July 2026. It asked the Commission to re-examine the EU-US Data Privacy Framework. That is the single biggest outside risk to any Dutch business relying on that route alone.