A guide to privacy and the GDPR in the Netherlands
GDPR stands for General Data Protection Regulation and is a European privacy regulation. The GDPR ensures that businesses and organizations process personal data carefully. That includes that businesses are not allowed to collect more data concerning people than necessary. Businesses must have good reasons to be allowed to collect personal data in the first place. In the Netherlands, the European GDPR is referred to as the AVG (Algemene Verordening Gegevensbescherming).
Who and what is the GDPR protecting?
The GDPR is protecting everybody’s right to privacy. For businesses, this means that it´s normally (unless there is a legal exception) not allowed to process special personal data, such as someone’s race, sexual orientation, religion, or health. For the collecting and processing of normal personal data, such as names, addresses, telephone numbers, postal codes and house numbers, businesses must have good reasons and they need a legal ground which allows them to collect these data and / or the person involved has consented to the processing of his / her data.
Who has to be GDPR compliant?
You need to comply with the GDPR if:
- Your business is located in one of the EU member states or in the EEA (European Economic Area);
- A subsidiary or branch office of your business is located in the EU or in the EEA;
- One of your customers, suppliers or any other stakeholders are residents of an EU member state, even if your business is not located in the EU, and if you offer goods or services to customers in the EU and/or if you are monitoring the behavior of residents of an EU member state.
If you do not comply with the GDPR principles, the Dutch Data Protection Authority (DPA), which is responsible for checking GDPR-compliances, may impose a hefty fine.
Privacy policy in the Netherlands
You are obliged to ensure that your customers and other stakeholders can execute their extensive privacy rights. Your customers and other stakeholders can lodge a complaint with the Dutch Data Protection Authority and the DPA is obliged to check every complaint.
To take their privacy rights seriously, you should enable your customers and other stakeholders to exercise their rights, such as
- To view, edit and a request to delete their data;
- To limit and withdraw any permissions they previously gave to you;
- To request their data to enable data portability.
You should draw up a privacy statement that is easy to understand and easy to find. In the privacy statement you should inform the reader about how and for what purpose you are using their personal data. Explain for how long you will store the data. In the privacy statement you also have to inform the reader about their privacy rights.
How to document and report data leaks in the Netherlands?
In case personal data that you have collected leaked (for example because you lost an usb-stick or sent an email to the wrong address or an accidental loss of personal data), you might have to report it to the Dutch Data Protection Authority within 72 hours and to the persons involved. You don`t have to report every (internal and external) data leak. Damsté can help you to figure out, which data leak you have to report to the DPA and/or the persons involved and how to do it.
Draft a data processor agreement with your data partners
If you are working with other companies that process personal data on your behalf, you have to make sure that you have a data processor agreement with them in accordance with the GDPR. Bear in mind, that Dutch privacy laws before 2018 weren´t as strict as todays GDPR and that your old data processor agreements probably have to be rewritten.
Damsté can help you to draw up a data processor agreement that considers all relevant aspects.
Do you have any questions?
If you have any more questions about privacy and the GDPR in the Netherlands, please contact our lawyers for privacy law Steven Erkel ([email protected]) or Irith Hoffmann ([email protected]).
-
Advocaat
