Regulation 2018
General Data Protection Regulation Implementation Act
Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)
Issued by Autoriteit Persoonsgegevens
Effective: 25 May 2018
Last amended: 1 Sep 2026
Plain-English summary
The Dutch GDPR Implementation Act (UAVG) refers to the national legislation responsible for tailoring the European Union General Data Protection Regulation (GDPR) to the national legal framework of the Netherlands. The act became effective from May 25, 2018, and gives the responsibility of enforcing privacy laws to an independent regulatory agency, the Autoriteit Persoonsgegevens (AP), with significant powers to impose administrative fines in the country. It lays down several important local requirements, including specifying the age of digital consent for children at 16 years and stringent regulations concerning the use of BSN. The law was most recently amended on September 1, 2026, through the introduction of tough regulations for the authentication of biometric data, additional data rights for children in the age group of 12-16 years, and compulsory publication of fines imposed by AP.
Who it applies to
Banking · Insurance · Telecom & Tech
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | Ongoing | AP | source | |
Personal data processing for financial crime prevention within the Netherlands is subject to an extremely stringent overlap between GDPR, the Dutch GDPR Implementation Act (UAVG), and the Wwft, where, instead of consent from the customer to process their data, there is a statutory duty placed upon companies to obtain identity and transaction data. Even though organizations are mandated to provide proactive notifications to customers through an online Privacy Policy that their personal data is being processed under statute for AML, the absolute prohibition of tipping off in the Wwft makes it such that the company is not obliged to inform the customer that their particular transaction is under scrutiny or has been reported to the FIU. More specifically, Article 41 of the Dutch UAVG gives the gatekeepers the ability to override the usual rights of a data subject, such as the Right to Erasure and the Right of Access. |
||||
| Personal data breach notification | Deadline Event-based | AP | source | |
Data breach notification requirements under the General Data Protection Regulation (GDPR) and the Dutch General Data Protection Regulation Implementation Act (UAVG) require data controllers to inform the Dutch Data Protection Authority (AP) about the incident within 72 hours of the moment it was detected, except in cases where there are no grounds to believe that such an incident may affect the rights and freedoms of individuals. In case of data compromise involving potential identity theft or financial fraud, a similar notification should be made to the victims themselves without unnecessary delays, but the requirement can be waived if the data has been encrypted or neutralized immediately. Also, every company is obligated to keep an exhaustive log of all incidents that have happened to it, including details of the incident itself, its consequences, and actions taken to counteract it. Failure to observe those timelines and maintain records may result in significant administrative sanctions of up to €10 million or 2% of the company's total annual turnover. Now, such sanctions are automatically published by AP as open records, increasing reputational risks for corporations. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.