Dutch Data Protection Authority to publicize privacy fines

Starting September 1, 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) will make administrative sanctions, such as fines for privacy violations, public by default. This change is part of the full implementation of the Collection Act on Data Protection (Verzamelwet gegevensbescherming), which amends the GDPR Implementation Act (UAVG).

Under the new rules, companies facing sanctions will face not only financial penalties and legal complications but also potential reputational damage. While the principle of transparency will be the standard, information that is exempt from disclosure under the Open Government Act (Woo) will remain protected.