Dutch DPA (AP) in 2026: the new enforcement policy, public fines and AI guidance

What changed at the Dutch DPA in 2026

Most coverage picks one of these stories. Read together, they show a regulator that explains itself early, publishes what it decides, and is preparing to supervise AI. Here are the dates that matter, each one taken from the AP's own announcements.

• Feb 5, 2026Ten municipalities fined €250,000 in total for keeping files with sensitive information about Muslim residents without their knowledge.
• Apr 13, 2026Draft enforcement policy published for public consultation. The AP received 12 responses.
• Apr 21, 2026Draft guidelines on the right to an explanation in automated decision-making opened for consultation.
• May 8, 2026€100 million fine for MLU B.V., the company behind the European version of taxi app Yango, for transfers of personal data to Russia.
• Jun 25, 2026Change of chair. Aleid Wolfsen hands over to Geert Potjewijd after 10 years.
• Jul 13, 2026Generative AI guidance and tool published, together with the AP's advice on Microsoft 365 Copilot at the municipality of Haarlemmermeer.
• Aug 20, 2026Twitch users advised to opt out of sharing data to train Amazon AI models.
• Aug 21, 2026€824.99 million fine for Uber for fully automated decisions to deactivate drivers.
• Sep 1, 2026Mandatory publication of GDPR sanctions takes effect through an amendment to the Dutch GDPR Implementation Act (UAVG).
• Sep 22, 2026Smart glasses warning. Filming others is almost always prohibited once images are shared or published.
• Oct 9, 2026New AI directorate. The AP starts its directorate for supervision and coordination of AI and algorithms.
• Oct 30, 2026Enforcement policy adopted and published in the Government Gazette (Staatscourant 2026, 38702).

A short history of the Dutch DPA

The AP is the independent supervisory authority for personal data in the Netherlands. It did not start with the GDPR. Dutch data protection supervision goes back to the Registratiekamer, set up under the Personal Data Registrations Act of 1989. In 2001, when the Personal Data Protection Act (Wbp) replaced that law, the regulator became the College bescherming persoonsgegevens (CBP).

On January 1, 2016 the CBP was renamed Autoriteit Persoonsgegevens and received the power to impose substantial administrative fines, together with the first Dutch data breach notification duty. The GDPR followed on May 25, 2018, alongside the Dutch GDPR Implementation Act (Uitvoeringswet AVG, or UAVG), which is the national law that the 2026 publication rule now amends.

Two things make the AP more important than the size of the Netherlands suggests. Many international companies have their European headquarters there, so under the GDPR one-stop-shop mechanism the AP leads cross-border cases against them. That is why a complaint from 171 French drivers ended in a Dutch fine for Uber. And since 2023 the AP has also coordinated supervision of algorithms and AI in the Netherlands, a task that is growing into AI Act supervision.

The new AP enforcement policy, explained

The enforcement policy (Handhavingsbeleid) was adopted on October 30, 2026 after a public consultation. The AP says organizations had questions about how an enforcement procedure works and what to expect, and that the policy is meant to give insight and a degree of predictability. It covers the GDPR and the other laws the AP enforces, including the Police Data Act, the Judicial and Criminal Records Act and newer EU rules such as the Digital Services Act and the regulation on political advertising.

It has six chapters: the AP's role, its principles, the instruments, how it chooses between them, the procedure, and cooperation with other regulators. These are the parts I think matter most in practice.

The principles the AP commits to

• A continuing violation must end. Dutch case law gives the AP a duty in principle to enforce. That means the violation has to stop. It does not mean a fine follows every time, and the AP decides that case by case.
• Enforcement must work. Action has to be effective, proportionate and dissuasive, and the AP picks the instrument it expects to have the most effect.
• The door stays open. During the procedure, and during objection or appeal, an organization can present a concrete plan to end the violation. Making a proposal is not an admission. If you have an FG, the FG's advice on the plan must be attached. The AP can still fine afterward, but it takes the remediation into account.
• You are kept informed. If the AP does not decide within the statutory period, it updates the organization at least every six months.
• The FG is informed. More on this below, because it changes the DPO's position.
• The complainant is informed and receives a copy of the enforcement decision, with confidential business information removed where the claim is justified.

The instruments, from lightest to heaviest

What decides which instrument you get

The AP applies the factors of Article 83(2) GDPR to every case, including cases where it is not planning a fine. On top of the familiar ones (nature, gravity and duration, intent or negligence, earlier violations, cooperation, categories of data), the policy names extra circumstances it will always look at:

• whether the violation produced a benefit for the organization;
• whether the organization ended the violation itself, and whether that was before or after it knew about the investigation;
• whether the violation followed from company policy;
• whether the FG had pointed out the risks in DPIAs or advice, and what the organization did with that;
• whether affected people were told, and whether they were compensated voluntarily.

How a case runs

1. Intention to enforce. The organization receives the investigation report, the underlying documents and a notice stating whether the AP intends a fine, a remedial measure, a reprimand or a combination. A registered FG receives a copy.
2. Your view. You respond in writing within a set term, and you can ask to explain it orally. The FG may attend that hearing as an observer.
3. Decision. The AP decides whether to act and with which instrument. In cross-border GDPR cases the draft decision is first aligned with the other EU authorities concerned.
4. Outcome. The procedure ends with an end letter or a formal decision.
5. Publication. The decision and a press release are published under the UAVG and the AP's publication rules.
6. Follow-up. Orders are checked after the deadline. Fines and forfeited penalties are collected by the Dutch central collection agency (CJIB). GDPR fines are only collected once objection and appeal are finished.

The AP says a procedure with a formal instrument takes nine to eighteen months on average. The statutory decision period for a fine is thirteen weeks after the notice of intent. For every full half year beyond that period, the AP reduces the final fine by 5%, capped at €5,000 per half year. The power to fine lapses five years after the violation, and for a continuing violation the clock only starts when the violation ends.

The acknowledgment and acquiescence procedure

This is the part that drew the most attention. When the AP intends to fine, it can offer a shorter route, or the organization can ask for it through its case handler. There is no right to it. The organization acknowledges the violation, accepts the fine and gives up objection and appeal. In return the AP lowers the fine by up to 35%.

Three conditions apply: a clear acknowledgment of the violation, a waiver of legal remedies, and agreement that the fine decision is published on the AP website with a press release. The organization sees the press release beforehand, only to check for factual errors. Exploratory talks are confidential, and what you share is not used in the main case if the talks fail. The route can be used once per case.

Public fines: the transparency rule and the 10-working-day period

Since September 1, 2026 the AP is legally required to publish its GDPR sanction decisions. The duty entered the Dutch GDPR Implementation Act through an amendment adopted by the House of Representatives, and it is commonly cited as the new Article 21b UAVG. It covers administrative sanctions such as a fine, an order subject to a penalty payment and a processing ban.

The AP was already publishing sanctions, but under its own policy. It had asked the legislator for this change for years. Its reasoning is that when a sanction is public, other organizations can see what went wrong and fix the same problem at home, and that a duty written in law gives more legal certainty than a policy.

How publication works, step by step

1. Notice. The AP tells the organization that it intends to publish the sanction and gives it the chance to respond.
2. Publication decision. The AP takes a final decision on publication.
3. Waiting period. The AP does not publish earlier than 10 working days after the organization receives that decision. Many articles call this the two-week rule. The AP's own wording is 10 working days.
4. Earlier publication. If the organization has already made the sanction public itself, or does not object, the AP may publish sooner.
5. Legal protection. The organization can object to the sanction and to the publication. Whoever objects to publication can also go to court to try to stop it.

The AP has also chosen to publish sanctions under the Police Data Act and the Judicial and Criminal Records Act in the same way. And anyone who uses the acknowledgment route described above agrees to publication up front, so no separate publication decision is needed in those cases.

AP fines so far: the public record

The AP keeps a public register of all fines and other sanctions it has imposed and published since 2018. At the time of writing it lists 49 items. The amounts below come from AP announcements. Several of these decisions are under objection or appeal, which I note where the AP says so.

Two patterns stand out. International transfers and automated decisions about people draw the largest amounts. And public bodies are fined too: the AP's policy states plainly that it can fine government, and the municipalities case shows it does.

How the AP guides before it fines: public examples

The enforcement policy describes a wide range of interventions, from explaining a norm and holding a conversation with an organization to a fine. The 2026 record shows the AP using the lighter end often and in public. These examples are useful because they show what the regulator expects before a case exists.

The lesson for a compliance team is simple. The AP publishes its expectations sector by sector, gives organizations a chance to fix things, and reserves investigations for those who do not. If your sector has received a public explanation from the AP, the regulator will assume you have read it.

What organizations in the Netherlands should do now

None of this requires a new program. It asks you to tighten the one you have, with the enforcement policy open next to you.

1. Put the FG on the record. Make sure your data protection officer is registered with the AP, gives written advice on DPIAs and high-risk projects, and that management's response to that advice is documented.
2. Map every automated decision about people. List where software decides without a human, check each one against Article 22 GDPR, and write the general explanation now.
3. Review your transfers. The two largest transfer fines went to data flows to the United States and Russia. Know where your processors and their sub-processors store data.
4. Fix the cookie banner. A visible reject button next to the accept button. The AP is checking, and the fix takes an afternoon.
5. Run the generative AI tool before you buy. Use the AP checklist before procurement, and clean up access rights and document labels before any assistant is switched on.
6. Prepare for a published decision. Agree who decides on objection, who drafts the public statement and who briefs the board, so that 10 working days is enough.
7. Keep remediation evidence. Ending a violation yourself, early, and telling the people affected are all named factors. You can only rely on them if you can show dates and documents.

I should be clear about the limits of this article. It is a practitioner's reading of public AP documents and it is not legal advice. For a live enforcement case you need a Dutch privacy lawyer.

Certifications that fit this picture, and what each one gives you in the Netherlands

I teach and mentor these PECB courses. The pattern I see with candidates from the Netherlands: organizations want one person who understands the law and one management system that proves the work is done. A certificate does not make an organization compliant, and no course replaces the standard or the regulation. What it does is give the person responsible a method and a recognized credential.

Why candidates in the Netherlands learn with reconn

• A trainer, not a sales desk. Every self-paced enrollment includes a 1-on-1 live online session with me, a PECB Certified Trainer, plus unlimited email and WhatsApp support until you clear the exam, within 12 months of enrollment.
• Everything PECB charges is included. Two exam attempts, the certification application fee and the first-year annual maintenance fee.
• EU VAT-compliant invoices. reconn is VAT registered in the EU, so Dutch buyers receive a tax-compliant invoice automatically, and companies can ask for corporate invoicing.
• Same-day enrollment, including weekends.