ডাচ তথ্য সুরক্ষা কর্তৃপক্ষ: কার্যাবলী, ক্ষমতা এবং অভিযোগ

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is the independent regulator that enforces the GDPR in the Netherlands: it handles complaints, receives data breach notifications, investigates organisations and can impose orders and fines. It is not a court: it does not settle your dispute with a company and cannot award you compensation, which is a matter for the civil courts.

The GDPR Implementation Act (Uitvoeringswet AVG) designates the AP as the supervisory authority under Article 51 GDPR and gives it legal personality. This article explains its tasks and powers, how a complaint and a breach notification work, and what to do if the AP investigates your organisation.

What does the AP supervise?

The AP supervises processing of personal data by public bodies and private organisations in the Netherlands. It also supervises organisations outside the EU that offer goods or services to, or monitor, people in the Netherlands.

Such non-EU organisations must appoint a representative in the EU under Article 27 GDPR; the absence of one is a separate ground for enforcement. Beyond the GDPR, the AP supervises the rules on police and judicial data, issues licences for private warning lists (for example on fraud) and coordinates the supervision of algorithms.

The AP is an administrative authority. The General Administrative Law Act (Algemene wet bestuursrecht, Awb) therefore governs how it takes decisions and how you challenge them. The government cannot instruct it in individual cases.

What are the AP’s tasks?

Article 57 GDPR lists the tasks: monitoring and enforcing the GDPR, raising awareness, advising government and parliament on legislation, handling complaints and cooperating with other European regulators. The AP also publishes guidance on how it applies the rules.

Guidance is not law, but it shows how the regulator will assess your case. One task requires you to go to the AP in advance: under Article 36 GDPR, you must consult the AP before processing starts if a data protection impact assessment (DPIA) shows a high risk that you cannot reduce.

Which powers does the AP have?

Article 58 GDPR gives the AP investigative powers and corrective powers. Cooperation with an investigation is compulsory.

The investigative powers include ordering information, carrying out audits and getting access to data, premises and equipment. The corrective powers range from a warning or reprimand to an order to comply with a data subject’s request, an order to inform individuals of a breach, a temporary or permanent ban on processing and the suspension of data transfers outside the EU.

The AP can also impose an administrative fine under Article 83 GDPR: up to €20 million or 4 percent of worldwide annual turnover, whichever is higher, for the most serious violations. Within that maximum, the AP’s published fining policy rules set a bandwidth based on seriousness, duration, intent, the number of people affected and cooperation. An order is often combined with an order subject to a penalty (last onder dwangsom). Read more in our article on the নেদারল্যান্ডসে প্রশাসনিক জরিমানা.

How do you file a complaint with the AP?

Under Article 77 GDPR you can file a complaint with the AP if you believe your personal data is processed unlawfully. You do this through the complaint form on the AP website.

First put your request to the organisation in writing and name the right you invoke, such as access or erasure. Under Article 12(3) GDPR the organisation must respond within one month, extendable by two months for complex requests. Keep the request, the reply, the dates and screenshots of the privacy notice.

The AP receives far more complaints than it can investigate and selects cases using published priorities. A complaint may only be registered as a signal. Under Article 78 GDPR you can go to court if the AP does not inform you of the progress or outcome within three months.

কখন ডেটা লঙ্ঘনের ঘটনা রিপোর্ট করতে হবে?

Under Article 33 GDPR a controller notifies a personal data breach to the AP without undue delay and, where possible, within 72 hours of becoming aware of it. You do not need to notify if the breach is unlikely to result in a risk to the people concerned.

If the risk is high, Article 34 GDPR requires you to inform those people as well, in clear language. Every breach goes into your internal register, notified or not; the AP asks for that register first.

The 72 hours run from awareness, not from the end of your investigation, so file an incomplete notification and supplement it later. A processor must inform its controller without undue delay, which is why your ডেটা প্রক্রিয়াকরণ চুক্তি should set a shorter internal deadline. If your main establishment is in another EU country, you notify that country’s lead authority.

What happens if the AP investigates your organisation?

An investigation usually starts with a written request for information. Answer accurately and on time, and keep your answers consistent with your records.

Before the AP takes an adverse decision, you have the right to be heard and to see the report of findings. If a fine is possible, Article 5:10a Awb gives the person questioned the right to remain silent about the infringement, and they must be cautioned about that right.

After a decision you have six weeks to file an objection (bezwaar) with the AP. Against the decision on the objection you appeal to the district court within six weeks, and then to the Administrative Jurisdiction Division of the Council of State (Raad van State). If a processing ban would halt your business, you can ask the court for a provisional measure (voorlopige voorziening).

একটি প্রতিষ্ঠান হিসেবে আপনাদের কী কী যাচাই করা উচিত?

• Your register of processing activities, with purposes, legal bases and retention periods.
• Your breach register and the documented risk assessment for each breach you did not notify.
• A working process for rights requests that meets the one-month deadline.
• আপনার কিনা গোপনীয়তা বিবৃতি matches your cookie banner, app permissions and actual practice.
• DPIAs for high-risk processing and safeguards for transfers outside the EU.
• Which authority is your lead authority if you operate in more than one EU country.

ব্যক্তিগতভাবে আপনার কী কী যাচাই করা উচিত?

• Whether you first sent a written request to the organisation and waited one month.
• Which right you invoke: access, rectification, erasure, objection or restriction.
• Whether you have the request, the reply and the dates in writing.
• Whether you want compensation; then you need the civil court, not the AP.
• The six-week deadline for going to court if the organisation refuses your request.

Should you go to the AP or to court?

The AP and the courts are separate routes, not stages of one process. A complaint to the AP does not stop any court deadline from running.

If a private organisation refuses your rights request, the GDPR Implementation Act lets you file a petition with the district court within six weeks of receiving the refusal. If the organisation is a public body, its decision is an administrative decision and you use objection and appeal under the Awb instead.

Compensation under Article 82 GDPR is always a claim before the civil court. Dutch courts award modest sums for non-material damage and require concrete adverse consequences. The AP’s findings can serve as evidence.

How does the one-stop-shop work in cross-border cases?

If processing affects people in several EU countries, the regulator where the organisation has its main establishment acts as lead authority (Article 56 GDPR). If that is the Netherlands, the AP coordinates with the other regulators concerned.

Disputes between regulators are decided by the European Data Protection Board (EDPB). Your main establishment is where decisions on processing are actually taken, not where the group is registered. The AP keeps its powers over Dutch establishments and over processing that is not cross-border.

What can we do for you with the Dutch Data Protection Authority?

আমাদের আইটি এবং গোপনীয়তা আইনজীবী assist organisations and individuals in their dealings with the AP.

• We draft your answer to an AP request for information and coordinate the file.
• We assess a data breach and prepare the notification within the 72-hour period.
• We file an objection or appeal against an AP order or fine within the six-week deadline.
• We draft a complaint to the AP or a petition to the district court about a refused rights request.
• We review your privacy statement, processing register and data processing agreements.

More background is in our আইটি আইন নির্দেশিকা, and the AP publishes its own guidance on তার ওয়েবসাইট.

সারাংশ

• The AP is the independent Dutch regulator that enforces the GDPR; it does not award compensation.
• Report a data breach within 72 hours of becoming aware of it, unless there is no risk.
• Against an AP decision you object within six weeks, then appeal to the district court.
• A refused rights request goes to the district court within six weeks; a complaint to the AP does not extend that deadline.

সচরাচর জিজ্ঞাস্য