By country

Privacy Policy Generator Netherlands

GDPR through the UAVG, cookie rules in the Telecommunicatiewet, and an AP with firm views on cookie walls.

Generate your privacy policy Read the privacy policy guide

A Dutch privacyverklaring is judged against GDPR as implemented by the UAVG, with the Autoriteit Persoonsgegevens as the named complaint route. The two Dutch-specific clauses are the BSN restriction and, for anyone with staff, the separate treatment of employee monitoring.

The Netherlands applies GDPR through the Uitvoeringswet AVG, with the Autoriteit Persoonsgegevens as regulator. Cookies are governed separately by Article 11.7a of the Telecommunicatiewet, which predates GDPR and which the AP enforces on its own terms.

The AP has been unusually direct about banner design. Its published position is that continuing to browse is not consent, that a cookie wall forcing acceptance in exchange for access generally fails the freely-given test, and that tracking cookies require consent obtained before they are placed. It has run sweeps and published the results.

Dutch employment law adds a second layer for staff data. Works councils have co-determination rights over systems capable of monitoring employees, which means a monitoring tool can be lawful under GDPR and still not deployable without agreement.

What a privacy policy in the Netherlands has to cover

Controller identity with a Dutch contact route, and the AP named as supervisory authority
Any processing of the BSN, with the statutory basis that permits it
Purposes and lawful bases, with the digital age of consent set at sixteen
Transfers outside the EEA with a current, named mechanism per destination
Employee monitoring handled in a separate staff notice rather than the public policy

How the Netherlands actually moves personal data

iDEAL and Dutch payment rails

iDEAL payments route through the customer’s bank and return an identity confirmation, which is a disclosure to a financial institution as well as a payment step.

Analytics under the narrow exemption

The AP accepts a limited consent exemption for analytics configured with no data sharing, no profiling and no advertising use. Standard configurations do not qualify.

Cookie walls and paid alternatives

The AP treats a hard cookie wall as invalidating consent. Any paid alternative model has to be described honestly in the policy.

Employee monitoring tools

Ticketing, analytics and productivity tools capable of individual monitoring, which trigger works council rights.

Transfers to US vendors

The AP expects a documented transfer mechanism per destination, and has been explicit that a Data Privacy Framework certification must actually be current.

Third parties the draft will ask you about

Mollie · Adyen · iDEAL · PostNL · Exact · AWS eu-west-1 · TransIP · Matomo

The rules that apply

GDPR + Uitvoeringswet AVG

The Dutch implementation, including national rules on identification numbers, criminal data and the digital age of consent set at sixteen.

Telecommunicatiewet Article 11.7a

Consent before placing or reading information on a device, with an exemption limited to what is strictly necessary and to certain analytics with no or little privacy impact.

Autoriteit Persoonsgegevens

The named supervisory authority, active on cookie banners, data broking and the security of personal data.

BSN restrictions

The Dutch citizen service number may only be processed where a statutory basis exists, which rules it out for most commercial purposes.

Works council co-determination

Systems capable of monitoring staff need works council agreement, independent of the GDPR basis.

What the generated privacy policy contains

Identity and contact details of the controller
Your legal entity, trading name, registered address and a working contact route - plus a representative or DPO where one is required.
Categories of personal data and their sources
What you collect directly, what you observe automatically, and what you receive from third parties such as payment providers or ad platforms.
Purposes and lawful basis, purpose by purpose
A table that pairs each processing purpose with its lawful basis rather than listing all six bases and hoping one fits.
Recipients and sub-processors
The categories of recipient, and for the ones that matter to users - payment, hosting, analytics, support - the named provider.
International transfers and their safeguards
Where data leaves its home jurisdiction, and the mechanism relied on: adequacy, standard contractual clauses, the UK addendum or IDTA.
Retention periods per data category
Concrete periods or the criteria used to set them, which is what regulators ask for first when a complaint lands.
Rights and how to exercise them
Access, rectification, erasure, portability, objection and restriction, with the actual route to make a request and the deadline you work to.
Complaints and supervisory authority
The regulator a user can escalate to, named, with a link - not a generic "your local authority".

Dutch compliance essentials

Configure the banner to place nothing before consent
And record the consent with a timestamp and the banner version.
Test whether your analytics really fits the exemption
If it shares data with the provider, it does not.
Set the digital age of consent to sixteen
With a parental consent route below it.
Take monitoring tools to the works council
Before deployment, not after.
Publish the AP as the complaint route
With its website, alongside your own contact for privacy requests.

Where this usually goes wrong

Consent inferred from continued browsing

The AP has said plainly this is not consent, and it is the finding its sweeps report most often.

A hard cookie wall

Blocking access unless a visitor accepts tracking generally fails the freely-given requirement in the AP’s view.

Claiming the analytics exemption without meeting its conditions

It requires no sharing with the provider for its own purposes and no use for profiling or advertising.

Processing the BSN without a statutory basis

It is restricted to specific legal purposes and cannot be used as a general customer reference.

Deploying monitoring tools without works council agreement

A GDPR basis does not substitute for co-determination.

Frequently asked questions

Are cookie walls legal in the Netherlands?

The Autoriteit Persoonsgegevens takes the position that a wall forcing acceptance in exchange for access does not produce freely given consent. Models offering a genuine paid alternative are contested rather than clearly permitted.

Do I need consent for analytics in the Netherlands?

Usually yes. There is a narrow exemption for analytics with no data sharing, no profiling and no advertising use, but standard configurations of the common tools do not meet it.

What is the digital age of consent in the Netherlands?

Sixteen. Below that, consent for information society services must come from a parent or guardian.

Is a privacy policy legally required?

If you process personal data, in almost every market yes. GDPR and UK GDPR require the disclosure at the point of collection, CCPA/CPRA requires a notice at collection plus an annually reviewed policy, and app stores and payment processors require a public policy URL before they will list or onboard you.

Can I copy another company’s privacy policy?

It is both a copyright problem and a compliance problem. A copied policy describes someone else’s data flows, processors and retention periods, so it is inaccurate the moment you publish it - and an inaccurate transparency notice is itself a breach of GDPR Article 13.

How often does a privacy policy need updating?

Whenever your processing changes - a new analytics tool, a new payment provider, a new market - and as a backstop, review it annually. CPRA makes the twelve-month review explicit.

Does PolicifyAI give legal advice?

No. PolicifyAI is a technology provider, not a law firm. The output is a structured, jurisdiction-aware draft that a qualified adviser should review before you rely on it.