The Dutch DPA’s tasks 

  • Making recommendations regarding legislation
    The Dutch DPA makes recommendations to the government regarding legislative proposals and draft texts of general administrative regulations that completely or to a significant extent deal with processing personal data.

  • Codes of conduct
    The Dutch DPA tests codes of conduct for social sectors relating to the handling of personal data

  • Regulations
    Regulations provide for the handling of personal data within organisations. Pursuant to the Wet politiegegevens (Wpg; Police Data Act), regulations are in some cases subject to testing by the Dutch DPA. In principle, the Dutch DPA only examines other regulations if there is a special reason to do so.

  • Notification and preliminary examination
    The processing of personal data has to be notified to the Dutch DPA in advance, unless an exemption applies. The Dutch DPA keeps a public register of these reports. The Dutch DPA must carry out preliminary examination for legitimacy purposes of certain processing that involves special risks.

  • Information
    The Dutch DPA can handle requests for recommendations or information about how to interpret the privacy legislation.

  • Sensitive data
    The Dutch DPA can grant exemption from the prohibition on processing sensitive data.

  • Transfer to third countries
    The Dutch DPA advises the Minister of Justice regarding permits for the transfer of personal data in cases of a lack of an adequate level of protection of personal data in a third country.

  • International affairs
    The Dutch DPA also monitors the processing of personal data in the Netherlands which is conducted in accordance with the law of another Member State and assists the other supervisory authorities in the European Union.

  • Mediation and handling of complaints
    At the request of an interested party, the Dutch DPA can mediate in disputes regarding the exercising of rights. The Dutch DPA can also check whether the way in which personal data have been used in a particular situation complies with the law.

  • Official investigation
    The Dutch DPA can also, on its own initiative, institute an investigation regarding compliance with the law.

  • Enforcement
    If governments, companies, other organisations or individual controllers fail to notify their processing of personal data, a fine can be imposed. In case of violation of the law or of regulations based on the law, the Dutch DPA can enforce administrative cooersion or impose a penalty.