Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
The Netherlands enforces GDPR via the Autoriteit Persoonsgegevens (AP) and the UAVG. NIS2 is now transposed and in force through the Cyberbeveiligingswet, which took effect 15 August 2026, just weeks after the EU referred the Netherlands to the CJEU for its delay.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in the Netherlands without transposition.
SourceThe Dutch GDPR implementation act, which replaced the earlier Wbp and sets national derogations plus the AP's powers.
SourceThe Netherlands' NIS2 transposition act, replacing the 2018 Wbni. Adopted by the Senate 7 July 2026, signed 8 July, and in force from 15 August 2026 with no transition period; covers roughly 8,000 organizations.
Source72 hours
GDPR Article 33 applies uniformly: notify the AP without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Autoriteit Persoonsgegevens (AP)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceCyberbeveiligingswet (NIS2)
Up to €10,000,000 or 2% of worldwide annual turnover for essential entities; up to €7,000,000 or 1.4% for important entities; individual directors can additionally be fined up to €25,000 for governance-duty breaches
Figures corroborated by Dutch legal-tracker sources; not verified directly against the consolidated Cyberbeveiligingswet statute text.
SourceApplicable , as of 2026-09-08
Fully transposed and in force. The Cyberbeveiligingswet was adopted by the Dutch Senate on 7 July 2026, signed 8 July 2026, and entered into force on 15 August 2026 with no transition period, replacing the 2018 Wbni. Note that on 8 July 2026, one day before Senate adoption, the European Commission had already referred the Netherlands (with Ireland, Spain, and France) to the CJEU over the earlier delay.
SourceAutoriteit Persoonsgegevens(AP)
Visit authority siteYes. The Cyberbeveiligingswet, the Dutch NIS2 transposition law, entered into force on 15 August 2026 with no transition period, replacing the earlier Wbni and bringing roughly 8,000 organizations into scope.
The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, within 72 hours of becoming aware of the breach where feasible, per GDPR Article 33.
Yes, beyond the entity-level fines, directors who fail to approve or oversee required cybersecurity measures can personally be fined up to €25,000 under the law's governance-duty provisions.
Talk to us about scoping an engagement around your specific regulatory context.
