Privacy / AI Governance / Security
Dutch AP finds Tax Administration complies with privacy law on only 2 of 12 topics under intensified oversight
The regulator's first annual report on the Belastingdienst credits progress on breach notification and DPIAs but flags weak algorithm justification, human oversight and security.
The Dutch data protection authority (AP) has published its first ‘Staat van de gegevensbescherming bij de Belastingdienst’, reviewing the Tax Administration under the intensified supervision it began in 2024. It assessed compliance and pace of improvement across 12 topics.
The Belastingdienst now meets the law on two: reporting data breaches and carrying out DPIAs. On the other ten it falls short. According to the AP, its selection algorithms are insufficiently justified to prevent discrimination, it cannot yet show human involvement in algorithmic decisions where the law requires it, personal data is not adequately secured, and its internal privacy organisation needs to work better. The citizen service number (BSN) is due to be removed from payment references for citizens at the end of 2026.
The AP’s instructions are legally binding and it can impose sanctions if they are not followed. Intensified supervision runs for now until mid-2029, with the next report due in January 2028.
Why it matters
The AP is measuring a large public body against concrete, auditable controls: algorithm justification, demonstrable human oversight of automated decisions, security and the functioning of the privacy organisation. Organisations using selection or risk-scoring algorithms should check they can document why selection criteria are non-discriminatory and evidence where a human reviews outcomes. While the Belastingdienst points to outdated IT systems, the AP says data protection must carry more weight and the areas with the greatest risks to citizens should be prioritised.
Status: Published. Intensified supervision continues, for now, until mid-2029
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- AI governance lead
- CISO
- Legal & compliance