NetherlandsUitvoeringswet Algemene verordening gegevensbescherming (UAVG), GDPR Implementation Act
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in the Netherlands, following the UAVG's institutional and procedural rules and Chapter 3-4 national derogations.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- May a controller rely on Article 41(1) of the UAVG to set aside a data subject's rights under GDPR Articles 12 to 21, given the AP's statement that it will not honor a controller's reliance on Article 41 in complaint proceedings because the article does not meet the requirements of GDPR Article 23?
What it makes you log
Logging duty
Article 15 charges named staff of the Autoriteit persoonsgegevens with supervising compliance and bars a secrecy defense against its demands for information or cooperation. The Act names no log, but a supervisory power to demand information about the processing can only be answered from records the controller keeps.
- Kind
- Implicit
- As of
- Provision
- Article 15
- Trigger
- personal_data_processing
What this law does
The Netherlands gives the General Data Protection Regulation (GDPR) domestic effect through the UAVG (GDPR Implementation Act, Wet van 16 mei 2018), in force since alongside the GDPR itself. UAVG Chapter 2 (Arts. 6-21b) establishes the Autoriteit Persoonsgegevens (AP) as supervisory authority, and Chapters 3-4 supply national derogations under GDPR Articles 6, 9, 10, and 23.
UAVG Article 1's definitions add only four defined terms and do not redefine any GDPR term including biometric data, so nothing in UAVG narrows a GDPR definition.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .