NetherlandsAP Enforcement, GDPR Article 82 and the WAMCA Collective-Action Regime
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person in the Netherlands who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Autoriteit Persoonsgegevens (guidance, recorded ); Hoge Raad, judgment of , ECLI:NL:HR:2026:1198 (Oracle and Salesforce v Stichting The Privacy Collective, 24/04650 and 24/04656) (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, applied directly by the Autoriteit Persoonsgegevens under UAVG Article 14(1). UAVG Article 17 additionally lets the AP impose an administrative fine at the same ceiling for unlawful processing of the criminal-conviction-and-offence-data category (GDPR Article 10, UAVG Article 31); despite its heading naming data of a criminal-law nature, Article 17 authorises an administrative fine only, not a criminal-law penalty on the controller. UAVG Article 18 confirms the AP may fine a government authority or public body at the same GDPR Article 83(4) to (6) tiers as a private undertaking, unlike some other member states that cap public-sector fines lower.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Autoriteit Persoonsgegevens (AP), the Netherlands' supervisory authority under the GDPR and the Uitvoeringswet AVG.
Enforcement record
Counts the Autoriteit Persoonsgegevens' own table of formal enforcement instruments in the Jaarverslag AP 2025 (published ): 4 boetes (fines) in 2025, down from 6 in 2024 (counting the fines only), alongside 1 last onder dwangsom (periodic penalty order), 9 berispingen (reprimands), 3 nacontrole en invordering (post-check and collection) actions and 1 vereenvoudigde afdoeningsprocedure (simplified settlement procedure). The report also records a fine of EUR 2,700,000 on Experian Nederland, imposed at the objection stage and not appealed. It does not list each 2025 fine with its amount. Public enforcement actions only; no private WAMCA claim count is published by the AP.
- As of
- Trend
- Falling
- Currency
- EUR
- Source link
- https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-04/AP%20Jaarverslag%202025.pdf
- Actions per year
- 4
Settledness
- As of
- Case link
- https://uitspraken.rechtspraak.nl/details?id=ECLI%3ANL%3AHR%3A2026%3A1198
- Guidance link
- https://www.autoriteitpersoonsgegevens.nl/en/themes/security/data-breaches/victim-of-a-data-breach-this-is-what-you-can-do
- Case citation
- Hoge Raad, judgment of , ECLI:NL:HR:2026:1198 (Oracle and Salesforce v Stichting The Privacy Collective, 24/04650 and 24/04656)
- Guidance body
- Autoriteit Persoonsgegevens
- Open questions
- Does a foundation that shows support for a WAMCA collective action through anonymous likes on its website meet the representativeness requirement of Article 3:305a(2) of the Civil Code, which looks to the foundation's support base and the size of the claims it represents?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and UAVG Articles 16 to 18 and the collective-action regime concern coercive orders, fines and claims. None of them states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
The Autoriteit Persoonsgegevens (AP) is the Dutch supervisory authority, with General Data Protection Regulation (GDPR) Article 83 fines plus UAVG's own administrative powers including a fine specific to unlawful processing of criminal-conviction data (Art. 17) and administrative fines against government bodies (Art. 18). GDPR Article 82 arms an individual with a direct private right of action, and the Netherlands' WAMCA collective-action regime is a live vehicle for privacy mass claims.
On the Hoge Raad (Supreme Court) set aside the Amsterdam Court of Appeal's 2024 judgments in the Privacy Collective collective action against Oracle and Salesforce and referred the case to the Court of Appeal in The Hague. Three foundations (SMC, SOMI and STBYP) brought WAMCA collective actions against TikTok group entities. The Amsterdam Court of Appeal gave an interim decision in the appeal on .
UAVG Article 21b requires the AP to publish a decision imposing an administrative sanction, except where the Wet open overheid bars disclosure.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .