Dutch data protection authority publishes final enforcement policy after public consultation
The Autoriteit Persoonsgegevens sets out its enforcement principles, how its procedure runs and how it cooperates with other supervisors, after receiving 12 responses to an April 2026 draft.
The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has published its enforcement policy. It explains how the AP uses its enforcement instruments when organisations do not comply with privacy rules.
The policy covers the principles the AP applies during the enforcement phase, how the enforcement procedure unfolds, and how the AP works with other supervisory authorities. According to the AP, organisations had raised questions about its procedure and what to expect during it, and the policy is intended to give them more clarity.
The AP published a draft for internet consultation on 13 April 2026 and received 12 responses. It says these made the final policy clearer and more accurate. A separate accountability document explains how the responses were handled.
Why it matters
Organisations processing personal data in the Netherlands now have a documented account of how an AP enforcement case proceeds, which DPOs and legal teams can use to update incident and regulator-engagement playbooks. Teams should compare their internal escalation and evidence-gathering steps with the procedure the AP describes, and note how cooperation with other supervisors could affect cases that touch several regulatory regimes. The accountability document is worth reading to see which consultation points changed the final text.
Status: Published. Final version follows a draft consulted on from 13 April 2026
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- Legal & compliance
- Privacy counsel