Consultation on the draft list of processing operations for which no DPIA is required (Dutch DPA)

What it is about

On 24 June 2026 the Dutch DPA published a draft list of types of processing for which no DPIA is needed, mainly aimed at SMEs and self employed entrepreneurs. Comments were possible until 10 August 2026; the consultation is closed. The DPA will publish a summary of the responses, submit the revised list to the EDPB and adopt the final list after that opinion, after which it will be published in the Government Gazette and on the DPA website and take effect.

What this means in practice

Until final publication nothing changes: you still assess yourself whether a DPIA is needed. The draft covers professionals, self employed persons and employers with up to 250 employees in European Netherlands, for among others HR administration, customer data, website visits and solo healthcare providers, each under conditions. Once adopted you may skip the DPIA for those operations, but all other GDPR obligations and DPIA duties under other legislation continue to apply. Watch the Government Gazette and the DPA website for the final list.

The GDPR articles concerned

• Article 35: Data protection impact assessment