Source: Autoriteit Persoonsgegevens
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) is asking for public input on a draft enforcement policy, according to an announcement published on the AP website on 13 April 2026. Anyone with an interest in how the AP handles privacy violations can submit a response by 17 May 2026.
The AP has prepared a draft enforcement policy that aims to give organisations more clarity about what happens when the authority investigates a potential privacy violation. According to the AP, there are questions among organisations about how enforcement procedures work and what they can expect during such a process. The draft policy is intended to answer those questions.
The document covers topics such as the principles the AP applies during enforcement, the enforcement tools it can use, the factors it weighs when deciding to act, how an enforcement procedure unfolds, the conditions under which a case can be resolved in consultation between the AP and the organisation involved, and how the AP cooperates with other supervisory authorities.
Free website scan covering GDPR, copyright, accessibility, security, and more.
Start free checkOn 19 March 2026, the CJEU ruled in Case C-526/24 (Brillen Rottler) that a data subject's first DSAR can be refused as 'excessive' under Article 12(5) GDPR if the controller can demonstrate abusive…
The AP is inviting experts, stakeholders and anyone with an interest to share their views on the draft. Responses will be used to improve and clarify the policy before a final version is adopted. The AP will publish a summary of the responses it receives, without including the names of individuals or organisations.
After the consultation closes, the AP will finalise the policy and publish it in the Staatscourant (the official Dutch government gazette) as well as on its own website. The policy takes effect on the date it is published in the Staatscourant. That date has not yet been determined.
If you want to respond, the AP asks you to send your input by 17 May 2026 and to indicate clearly which page and passage your comments relate to.
If your website collects personal data, such as through a contact form, newsletter sign-up or online shop, you are already subject to the AP's oversight. This consultation is a chance to understand how the AP approaches enforcement before the final policy is set. It is also a good moment to check whether your own privacy practices are in order, using resources like our GDPR compliance checklist and our guide on privacy policy requirements.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published its 2025 annual report on 2 April 2026, outlining enforcement actions and priorities across five focus areas.
The EDPB adopted its work programme for 2026-2027 during its latest plenary on 12 February 2026, focusing on easing compliance and strengthening cooperation.