Amendment to the Dutch GDPR Implementation Act: DPA must publish GDPR sanctions from 1 September 2026

What it is about

Until now the DPA published GDPR sanctions under its own disclosure policy. Following a parliamentary amendment to the Dutch GDPR Implementation Act (UAVG), from 1 September 2026 the DPA is legally required to publish GDPR sanction decisions, such as fines, penalty orders and processing bans. The DPA first informs the organisation of its intention to publish and gives it the opportunity to respond, then takes a final decision on publication. It publishes no earlier than ten working days after the organisation has received that decision, unless the organisation already disclosed the sanction itself or does not object. The organisation can object to the sanction and the publication, and anyone objecting to publication can go to court to try to stop it. Through a policy change, the DPA will also publish sanctions under the Police Data Act (Wpg) and the Judicial and Criminal Records Act (Wjsg) in the same way.

What this means in practice

Assume every GDPR sanction by the DPA will become public, including penalty orders and processing bans, not only fines. Respond to the notice of intended publication, and expect publication from ten working days after receiving the final publication decision; to try to stop publication, object within that period and seek court relief if needed. Prepare communications and a legal response in advance. Publication also clarifies the DPA's standards, so use published decisions as a checklist.

The GDPR articles concerned

• Article 58: Powers
• Article 83: General conditions for imposing administrative fines