The Dutch DPA's enforcement policy: what your municipality needs to know when the regulator comes

Imagine you are the data protection officer (DPO) of a Dutch municipality. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has investigated the selection model your municipality uses to pick social assistance files for a review. Today an investigation report lands on the desk of the municipal secretary, with a letter: the AP intends to take enforcement action. What happens now, what can the municipality still do, and what is expected of you?

Since 30 October 2026 this is set out on paper. On that day the AP published its final enforcement policy (in Dutch), after a consultation that started on 13 April 2026 and drew twelve responses.

What the AP published

The policy sets out six principles, the instruments the AP has (from reprimand and order subject to a penalty payment to a processing ban and a fine), the factors that determine the choice and the course of the procedure. It comes with an accountability document in which the AP explains what it did with the responses.

Worth knowing: the policy says nothing about how the AP chooses which cases to investigate. The AP writes in the accountability document that this is a deliberate choice. The policy only starts once the AP has found a breach, and in a few cases before that, for example with a formal warning about processing that has not yet started.

Lesson 1: a breach must end, a fine is a separate choice

If the AP finds a breach, it must in principle be ended. In Dutch administrative law this is called the principled duty to enforce. A fine does not follow automatically. The AP refers to the Land Hessen judgment of the Court of Justice (C-768/21, 26 September 2024): a supervisory authority is not required to impose a corrective measure such as a fine if that would not be appropriate, necessary or proportionate.

The reverse also holds: the lightest measure is not the starting point. According to the policy, closing a case with only a closing letter is possible only in special circumstances, because as a rule breaches are too serious for that. And the AP can combine measures, for example an order subject to a penalty payment together with a fine.

Lesson 2: for municipalities the AP's own Fining Policy Rules apply

The GDPR lets each member state decide whether public authorities can be fined (Article 83(7) GDPR). In the Netherlands they can: the policy expressly states that the AP can also fine the government. In February 2026 ten municipalities were each fined, 250,000 euros in total, for reports on Muslim residents that they held without a legal basis.

To set the amount for public authorities, the AP does not use the European calculation guidelines (EDPB Guidelines 04/2022) but the Fining Policy Rules of the Dutch DPA 2023. According to the policy, the European guidelines do not apply to public authorities or to individuals not acting as a business. The AP does assess the factors of Article 83(2) GDPR in the way Guidelines 04/2022 describe.

Lesson 3: talks on remediation run alongside the procedure, not instead of it

The AP is open to talks with an offender who wants to end the breach. That is possible during the enforcement procedure and also during objection or appeal. There are two conditions and one strong recommendation:

• The proposal is a clear and specific plan: which measures you take and when. The draft said "a fully developed proposal"; the AP made clear that the plan can be adjusted in the talks.
• If the organisation has a DPO, you attach the DPO's advice. The AP writes that this is not a legal duty but a condition of this offer.
• The AP recommends starting early, for example at the same time as your written view. The talks do not pause the procedure; once the AP decides, the talks end.

A proposal does not count as admitting the breach. But the AP keeps the option of imposing a fine anyway. It can take the actual effects of ending the breach into account when choosing the measure. AP staff give no advice in these talks; they only test whether your plan ends the breach.

Lesson 4: the DPO is not at the table, but reads along

If the municipality has notified a DPO to the AP, the DPO receives at the start a copy of the investigation report or draft decision and the intention to enforce. After that also the progress updates, a copy of the minutes of a hearing on the offender's view and the final decision or the letter in which the AP decides not to enforce. The DPO may attend such a hearing as an observer.

The AP expressly does not approach the DPO as the municipality's representative. That would not fit the DPO's independent position (Article 38 GDPR). The municipality must itself involve the DPO in its written view.

The final text makes explicit: when choosing the measure, the AP considers to what extent the DPO had warned the organisation about the risks, for example in a DPIA or advice, and what the organisation did with that. For a DPO that means: put your advice in writing. For the municipality: follow it, or record why not.

Lesson 5: admission and acquiescence earns a discount, but you give up a lot

If the AP intends to impose a fine, it can close the case through the admission and acquiescence procedure. The offender admits the breach and accepts the fine; the AP reduces it by up to 35 percent. The case must lend itself to this and there must be time to be saved. The AP first sets the fine itself under the normal rules; the amount is not negotiated.

The conditions are strict:

1. You clearly and unambiguously admit the breaches in the report.
2. You waive objection, appeal and further appeal.
3. You agree to publication of the fining decision on the AP's website, with a press release that also goes out on social media. You may check the text of the press release beforehand for factual errors only.

There is no right to this route, the AP decides case by case, and if it is broken off, it is not restarted in that case. The exploration is confidential: if it fails, the AP does not use new information you raised in it in the regular procedure, unless you consent. For a municipality the third condition often weighs most: you agree in advance to publication and a press release. In the regular route the AP publishes too, but there it first takes a separate decision on publication. So discuss the route early with the municipal executive.

Lesson 6: expect nine to eighteen months

According to the AP an enforcement procedure takes nine to eighteen months on average. Some time limits from the policy:

• The Dutch General Administrative Law Act gives the AP thirteen weeks from the date of the investigation report to decide on the fine (Article 5:51(1)); the policy counts from when the intention is sent, which usually comes with the report. That limit is not always met, and the power to fine does not lapse as a result.
• For each full half year after that limit, the offender gets a 5 percent reduction of the fine, up to 5,000 euros per half year. For the first half year the AP may refuse the reduction if the delay results from the circumstances of the case.
• If the AP does not decide within the statutory time limit, it informs the offender of the progress at least every six months.
• The power to impose a fine lapses five years after the breach (Article 5:45 of that Act); during objection or appeal that period is suspended. For a continuing breach the period only starts when it ends. According to the AP, a data breach that was never notified is such a continuing breach.

Lesson 7: a complaint against your municipality does not automatically lead to further investigation

On 12 November 2026 the East Brabant District Court ruled on a private individual's complaint against a healthcare institution (ECLI:NL:RBOBR:2026:8068, in Dutch). A complaint under Article 77 GDPR is a request for enforcement and therefore an application under Dutch administrative law. The AP must keep the complainant informed of the progress and outcome (Article 77(2) GDPR); if the complainant hears nothing within three months, they can go to court (Article 78(2)). After a progress update, the AP must decide within a reasonable time. What is reasonable depends on the nature of the complaint. Because the AP had sent a timely progress update and the complaint had been supplemented 25 times, the reasonable time had not yet passed; the notice of default came too early.

On the merits, the AP was allowed to reject the complaint without further investigation. A breach could not be established without further investigation, the wider societal impact was limited, the AP's capacity is limited, and the subject did not fall under its focus areas for 2026: mass surveillance, reliable digital services and the rapid development of AI. The AP stayed within its margin of discretion.

For a municipality this cuts both ways. A single complaint about an error in a file does not automatically lead to further investigation. But complaints about cameras, algorithms and AI at the municipality fall squarely under those focus areas. According to the policy, the complainant receives a copy of an enforcement decision. If you want data redacted, you must explain why it is confidential; the AP tests that against Article 5.1(1)(c) and (2)(f) of the Dutch Open Government Act. The ruling can still be appealed to the Council of State.

What the European guidelines add

On 17 September 2026 the EDPB adopted a consultation version of Guidelines 04/2026 on when a supervisory authority imposes a fine, in addition to or instead of other measures. The guidelines set out five steps. A fine requires intent or negligence, and negligent also covers someone who should have known the conduct was unlawful. If the infringement is minor, as a rule no fine follows. If it is not, there is a strong presumption that a fine will follow.

This is not yet a final text; comments can be submitted until 13 November 2026. For public authorities the guidelines apply only insofar as national law allows fines on them, which Dutch law does. In a footnote the AP says it will adapt the policy as soon as possible if the EDPB revises Guidelines 04/2022; the policy does not mention Guidelines 04/2026.

What the AI Act adds, and what it does not

The enforcement policy now covers the GDPR and a range of other laws, such as the Digital Services Act and the Data Act. According to the AP, the AI Act will follow later, with the Dutch implementing act.

That act does not exist yet. The Netherlands has not yet designated a market surveillance authority for the AI Act. On 20 April 2026 the government proposed to use existing supervisors per domain, with the AP where there is none, and the AP and the Dutch Authority for Digital Infrastructure as coordinators. The implementing act is planned for the second quarter of 2027. Under the AI Act too, each member state decides whether public authorities can be fined (Article 99(8) AI Act).

Meanwhile the GDPR remains the framework the AP uses against AI use involving personal data. A selection model for social assistance files is an example. If such a system is intended to assess whether residents are eligible for a benefit, or to grant, reduce, revoke or reclaim it, it is in principle high risk under the AI Act (Annex III point 5(a)), unless the exception in Article 6(3) applies; that exception never applies if the system profiles people. The high-risk obligations for Annex III systems apply from 2 December 2027; for a public-authority system already in use before then, they apply only on a significant change and by 2 August 2030 at the latest (Article 111(2)).

For a bank and a school

A bank is an undertaking. For the amount of a fine, the European calculation guidelines in Guidelines 04/2022 therefore apply, in which turnover helps set the statutory maximum and starting amount. If the main establishment is in the Netherlands and the processing is cross-border, the AP as lead supervisory authority coordinates its draft decision with the other authorities. According to the policy that takes four to six weeks, and in a dispute via the EDPB up to sixteen weeks more.

A school or university often has a DPO too. The lessons on the remediation plan, the DPO's advice and written records then apply in the same way. Whether the AP uses the European calculation guidelines or its own Fining Policy Rules for a school depends on whether the school counts as a public authority. The policy does not work that out per sector.

What to do now

1. Make sure your DPO is notified to the AP, so the DPO receives the copies.
2. Put DPO advice and DPIAs in writing, together with what the municipality did with them.
3. Agree who writes the written view when an intention to enforce arrives, with the DPO involved.
4. When a breach is found, start right away on a clear and specific remediation plan with a timeline.
5. Discuss in advance with the municipal executive whether admission and acquiescence is an option, including publication.
6. For each enforcement decision, record which passages are confidential and why.
7. Check whether any breaches are continuing, such as an unnotified data breach: the limitation period only starts when it ends.

To check which GDPR and AI Act obligations apply to your own processing, use the free case check. Decisions and guidelines on the GDPR are collected under GDPR guidelines.

What remains open

• How the AP prioritises. The policy deliberately says nothing about it. The AP publishes periodic focus areas; for 2026 the East Brabant ruling names mass surveillance, reliable digital services and AI.
• The European guidelines. Guidelines 04/2026 are a consultation version. The final text may differ.
• Appeal. The East Brabant ruling is not yet final.
• Supervision of the AI Act. Until the implementing act exists, it is not settled who supervises which part in the Netherlands.