Netherlands

The Dutch GDPR Implementation Act (UAVG) refers to the national legislation responsible for tailoring the European Union General Data Protection Regulation (GDPR) to the national legal framework of the Netherlands. The act became effective from May 25, 2018, and gives the responsibility of enforcing privacy laws to an independent regulatory agency, the Autoriteit Persoonsgegevens (AP), with significant powers to impose administrative fines in the country. It lays down several important local requirements, including specifying the age of digital consent for children at 16 years and stringent regulations concerning the use of BSN. The law was most recently amended on September 1, 2026, through the introduction of tough regulations for the authentication of biometric data, additional data rights for children in the age group of 12-16 years, and compulsory publication of fines imposed by AP.

The law of Anti-Money Laundering and Anti-Terrorist Financing (Wwft) is the main Dutch anti-money laundering legislation that aims at protecting the financial system from money laundering and terrorist financing. It became active on August 1, 2008, setting out specific gatekeepers of the industry (banks, notaries, accountants, and traders) and obliging them to carry out strict client due diligence (KYC/UBO) and instantly report any suspicious transactions to FIU-Nederland. The regulation is implemented by specific agencies, among which is a newly created Dienst Financieel-Economische Integriteit (DFEI) for non-financial service providers, along with De Nederlandsche Bank (DNB) and the AFM. On January 1 and July 1, 2026, the legislation has been significantly updated, imposing a strict cash transaction limit of €3,000 for commercial goods traders and providing legal rights to the FIU to order the temporary freezing of transactions for up to 10 working days during the evaluation process.