Consultation on the Dutch DPA's enforcement policy (April 2026)

What it is about

On 13 April 2026 the Dutch DPA put a draft enforcement policy out for consultation. It sets out the principles: a duty to act against ongoing breaches, effect oriented action, openness to talks on ending a breach, and keeping the offender, the DPO and the complainant informed. It also sets out the tools: reprimand, making a commitment binding (under the DSA only), a plain order, an order subject to a penalty payment and an order enforced by administrative action, withdrawal of GDPR certification, processing restriction and ban, administrative fine and closing letter. On top of that come formal preventive tools: a temporary restriction or ban during an investigation, a formal warning on intended processing, and an order to prevent repetition or a preventive order. The draft also covers settlement in dialogue with a fine reduction of up to 35 percent, and a 5 percent fine discount for each full half year past the decision deadline (capped at 5,000 euros per half year). Responses were accepted until 17 May 2026. The consultation is closed and the DPA will publish a summary of the responses.

What this means in practice

A party that admits a GDPR breach, waives objection and appeal, agrees to publication of the fine decision and compensates data subjects can settle the procedure in dialogue. The fine is then reduced by up to 35 percent. There is no right to such a settlement. A binding commitment instead of a fine or penalty order is only available under the DSA, not the GDPR. Keep your DPO involved, since the DPA sends the DPO copies of key documents. Also expect more than fines, such as a temporary processing ban during an investigation or a preventive order. The policy has not yet been finalised.

The GDPR articles concerned

• Article 58: Powers
• Article 83: General conditions for imposing administrative fines