GDPR / AVG
What is GDPR / AVG
On May 25, 2018, the European Union’s GDPR (General Data Protection Regulation) came into force across all member states.
In the Netherlands, this means the GDPR takes precedence over the previous national data protection AVG law. Regulation – 2016/679 – EN – gdpr – EUR-Lex
The GDPR establishes strict rules to safeguard personal data, that is, any information relating to an identified or identifiable natural person, and defines how organizations must handle, store, and process such data.
As a result, this regulation affects not only businesses, but any entity, public authorities, private companies, service providers or third-party processors that handles the personal data of EU residents.
Why the AVG still Matters
The national law, AVG, complements the European GDPR and adapts its provisions to the Dutch legal context. Privacy legislation | Autoriteit Persoonsgegevens
Among its aims are: Ensuring transparent data-processing practices, protecting digital rights, and establishing clearer obligations for organizations operating in the Netherlands.
The law strengthens citizens’ rights, including rights of access, correction, erasure, portability, and more, while introducing the requirement for a Data Protection Officer (DPO) / Functionaris Gegevensbescherming (FG) for certain organizations.
What This Means for Your Business / Organization
Compliance by default:
Our Data Protection & Compliance Services
FAQ
Any company, organization, or public authority, national or international, that processes personal data of individuals residing in the EU, regardless of where the company is based.
Individuals have rights including access, correction, erasure (“right to be forgotten”), data portability, restriction or objection to processing, and protection from purely automated decisions.
If your organization handles certain types of data (e.g. sensitive data) or engages in large-scale processing, GDPR / AVG may require you to appoint a DPO / FG (in-house or external).
Only as long as strictly necessary for the purpose it was collected. Unnecessary storage may violate data minimization and storage limitations under GDPR / AVG.
Non-compliance can lead to administrative sanctions under AVG and GDPR, including significant fines and reputational damage.
Stay Informed — Visit Our Blog
For regular updates on privacy, compliance, security and data-protection best practices, check our blog