Netherlands

The Dutch GDPR Implementation Act (UAVG) refers to the national legislation responsible for tailoring the European Union General Data Protection Regulation (GDPR) to the national legal framework of the Netherlands. The act became effective from May 25, 2018, and gives the responsibility of enforcing privacy laws to an independent regulatory agency, the Autoriteit Persoonsgegevens (AP), with significant powers to impose administrative fines in the country. It lays down several important local requirements, including specifying the age of digital consent for children at 16 years and stringent regulations concerning the use of BSN. The law was most recently amended on September 1, 2026, through the introduction of tough regulations for the authentication of biometric data, additional data rights for children in the age group of 12-16 years, and compulsory publication of fines imposed by AP.