Netherlands

Whoever distributes, offers, publicly displays, produces, imports, transships, exports, acquires, possesses, or accesses a visual representation of a sexual act involving a person who apparently has not yet reached the age of eighteen, whether or not that person is actually involved, is punished with imprisonment of up to six years or a fine of the fifth category.

The provision does not require the depicted minor to be real, so it reaches a computer-generated or otherwise synthetic depiction on its own terms. Its predecessor, art. 240b, carried the same apparent-involvement wording with a four-year maximum before the Wet seksuele misdrijven renumbered and raised the penalty for the current text, effective 1 July 2024.

UAVG Article 29 is a genuine Dutch national addition beyond the General Data Protection Regulation (GDPR) Article 9 baseline, confirmed verbatim: it exercises the GDPR Article 9(2)(g) substantial public-interest derogation to permit processing biometric data for unique identification specifically where necessary for authentication or security purposes.

The provision does not itself enumerate safeguards, a retention limit, or qualifying use cases beyond authentication or security, and no further AP guidance elaborating its boundaries was found. The exception applies equally to a voiceprint and a faceprint; UAVG Article 29's own text does not distinguish by modality, and no AP guidance specifically addressing voiceprint biometrics as distinct from facial biometrics was found.

A controller must notify the AP within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. UAVG Article 42 adds one national exception to the Article 34 individual-notification duty: it disapplies Article 34 for financial undertakings within the meaning of the Wet op het financieel toezicht (Financial Supervision Act).

Corrected during the #8352 wave 4 review: the article's full text is a single sentence stating exactly this exception, not merely confirmed by a table-of-contents heading.

The Netherlands gives the General Data Protection Regulation (GDPR) domestic effect through the UAVG (GDPR Implementation Act, Wet van 16 mei 2018), in force since 25 May 2018 alongside the GDPR itself. UAVG Chapter 2 (Arts. 6-21a) establishes the Autoriteit Persoonsgegevens (AP) as supervisory authority, and Chapters 3-4 supply national derogations under GDPR Articles 6, 9, 10, and 23.

UAVG Article 1's definitions add only four defined terms and do not redefine any GDPR term including biometric data, so nothing in UAVG narrows a GDPR definition.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Netherlands-specific derogation from this framework was identified in the UAVG.

General Data Protection Regulation (GDPR) Articles 12-23 apply directly: access, rectification, erasure, restriction, portability, objection, and Article 22 automated-decision rights. UAVG Article 40 gives GDPR Article 22 its own domestic exceptions (not to be confused with UAVG's own Article 22, the special-categories prohibition, a distinct provision under the same number).

UAVG Article 43, confirmed verbatim, is the significant national narrowing: for processing carried out exclusively for journalistic purposes or academic, artistic, or literary expression, most of GDPR Chapter III's data-subject rights and Chapters IV-VII do not apply, and Articles 9 and 10 are disapplied to the extent the processing serves those purposes.

The Autoriteit Persoonsgegevens (AP) is the Dutch supervisory authority, with General Data Protection Regulation (GDPR) Article 83 fines plus UAVG's own administrative powers including a fine specific to unlawful processing of criminal-conviction data (Art. 17) and administrative fines against government bodies (Art. 18).

GDPR Article 82 arms an individual with a direct private right of action, and the Netherlands' WAMCA collective-action regime is a live vehicle for privacy mass claims: a Consumentenbond and Stichting Take Back Your Privacy claim against TikTok, over unauthorized collection of children's personal data, is currently paused pending a Hoge Raad ruling in a related Oracle/Salesforce case expected 4 September 2026.

UAVG Chapter 3 Section 3.1 (Arts. 22-30) implements General Data Protection Regulation (GDPR) Article 9's special-category regime with article-by-article national exceptions: research and statistics, racial or ethnic origin, political opinions, religious or philosophical beliefs, and genetic data (Arts. 24-28), a health-data exception for administrative bodies, pension funds, and employers (Art. 30), and rules on criminal-conviction data (Art. 33, corrected during the #8352 wave 4 review from a mistyped Art. 31, which is a distinct provision on processing under governmental oversight).

Article 46 restricts processing of the citizen service number (BSN) to statutory or law-designated purposes; corrected during this review, its full text is in fact present and readable on the stored page, not truncated as previously stated. The AP's own scraping guidance (published 1 May 2024, as described in secondary commentary) states that publicly available information does not become lawfully processable merely because the source was public.

Whoever intentionally and unlawfully breaks into an automated work, or part of one, is punished with imprisonment of up to two years or a fine of the fourth category. Breaking in requires the access to have been obtained by breaching a security measure, a technical intervention, false signals or a false key, or assuming a false identity.

Copying, tapping, or recording data after that unauthorized access raises the maximum to four years, and doing so through a public telecommunications network for unlawful gain or to pivot to a third party's system also carries a four-year maximum. Because the offense turns on defeating one of the listed access methods, a scraper reading a public, unauthenticated page without doing so falls outside the provision's plain text.

Article 15n exempts a reproduction that a research organization or cultural heritage institution makes for text-and-data-mining scientific research on a work to which it has lawful access, provided the reproduction is stored with an appropriate level of protection; a rightsholder may take proportionate security measures, and the exception cannot be contracted around.

Article 15o extends the exception to any miner with lawful access, but only where the rightsholder has not expressly reserved the right in an appropriate way, such as machine-readable means on a work made available online; a reproduction made under either article may be kept only as long as needed for the mining.

A database producer, defined as the person who bears the investment risk for the database, has the exclusive right to authorize extracting or re-utilizing the whole or a qualitatively or quantitatively substantial part of a database's contents, and to prevent the repeated and systematic extraction or re-utilization of insubstantial parts where that conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

The right arises when the database's production is completed and lapses fifteen years after 1 January of the following year, or fifteen years from first being made available to the public if that happened earlier; a substantial new investment restarts the term. Circumventing an effective technical protection measure knowing or reasonably suspecting that is unlawful.

Since 21 November 2025, the right does not apply to data obtained from or generated by a connected product or related service within the meaning of Article 43 of Regulation (EU) 2023/2854 (the EU Data Act).

An audiovisual media provider may only offer content capable of harming the physical, mental, or moral development of a person under sixteen if the institution responsible for the content is affiliated with the organization the Minister has recognized under Article 4.2, and is bound by that organization's rules and supervision, per Article 4.1. Article 4.1a requires the most harmful content, expressly including pornography, to be made technically inaccessible to persons under sixteen.

It separately forbids the commercial processing of any personal data of minors collected under this scheme. The Commissariaat voor de Media supervises compliance with the classification scheme. A video-sharing platform provider established in the Netherlands carries a parallel code-of-conduct duty under Mediawet 2008 Chapter 3a.

The publisher of a press publication has the exclusive right to authorize the online reproduction and the making available to the public of its press publication by an information-society-service provider, per Article 7b(1). The right does not reach private or non-commercial use by individual users, hyperlinking to a press publication, the use of single words or very short fragments, or the use of a work whose own protection term has expired, per Article 7b(2).

The right cannot be invoked against the author, performer, or producer whose own protected material is embedded in the press publication, per Article 7b(3). The author of a literary, scientific, or artistic work carried in a press publication is entitled to an appropriate share of the revenue the publisher receives for the work's use by an information-society-service provider, per Article 7b(5).