Guideline
Dutch DPA publishes its final enforcement policy
- Date
- Status
- final
- Body
- Autoriteit Persoonsgegevens
- Reference
- Handhavingsbeleid AP (30 oktober 2026), met verantwoordingsdocument
What it is about
On 30 October 2026 the Dutch DPA published its enforcement policy, after the April 2026 consultation that drew 12 responses. The policy sets out the principles (acting against an ongoing breach, effect oriented action, openness to talks on ending the breach), the instruments and the course of the procedure. Settling in dialogue is now called the admission and acquiescence procedure: the offender admits the breach and accepts the fine, and the DPA reduces the fine by up to 35 percent.
What this means in practice
If the Dutch DPA investigates you, you now know in advance how the procedure runs. There is no right to the admission and acquiescence procedure, and the DPA sets the fine itself first; the amount is not negotiated. A clear and specific plan to end the breach can be discussed. For that offer the DPA asks for the advice of your DPO; this is not a legal duty but a condition of the offer.
The GDPR articles concerned
Source: Autoriteit Persoonsgegevens, Handhavingsbeleid AP gepubliceerd (met beleid en verantwoordingsdocument als PDF)checked on 5 November 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
The counterpart in the other law
Case law
- Deutsche Wohnen: a fine on a legal person needs no identified natural person, but does require fault
2023-12-05 · final, Hof van Justitie van de EU (Grote kamer), Deutsche Wohnen SE tegen Staatsanwaltschaft Berlin
- Land Hessen: the supervisory authority need not always fine where the organisation already remedied the breach
2024-09-26 · final, Hof van Justitie van de EU (Eerste kamer), TR tegen Land Hessen
- Reddit's summary proceedings against the DPA over a penalty order and legal privilege dismissed
2026-03-04 · status not established, Rechtbank Den Haag, voorzieningenrechter
- Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak
- Council of State upholds 6,000 euro DPA fine for recruitment firm
2024-05-29 · final, Raad van State, Afdeling bestuursrechtspraak
- Interim judge suspends DPA penalty order against Northwave: exhaust powers against the hosting provider first
2024-03-26 · final, Rechtbank Midden-Nederland, voorzieningenrechter (zittingsplaats Utrecht)
- Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems
Guidelines
- Guidelines 04/2026 on when a supervisory authority imposes a GDPR fine
2026-09-17 · under consultation, European Data Protection Board (EDPB)
- Consultation on the Dutch DPA's enforcement policy (April 2026)
2026-04-13 · under consultation, Autoriteit Persoonsgegevens
Enforcement and fines
- DPA cuts Kruidvat fine to 50,000 euros on objection
2025-05-27 · status not established, Autoriteit Persoonsgegevens
- Ten municipalities fined a total of 250,000 euros for unlawful files on Muslim residents
2026-02-03 · final, Autoriteit Persoonsgegevens
- Coolblue fined 40,000 euros on objection for cookies without consent
2024-12-23 · status not established, Autoriteit Persoonsgegevens
- Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens
Legislation in motion
- Amendment to the Dutch GDPR Implementation Act: DPA must publish GDPR sanctions from 1 September 2026
2026-09-01 · in force, Wetgever (Tweede Kamer) en Autoriteit Persoonsgegevens