Dutch data regulator offers up to 35% off fines for admitted breaches

Dutch data regulator offers up to 35% off fines for admitted breaches

30 October 2026: The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has published the policy it follows once it finds an organisation breaking the privacy rules: which sanction it picks, how a formal case runs from the investigation report to the decision, and a settlement route that cuts a fine by up to 35% for a company that admits the breach and gives up its right to appeal. A formal case takes nine to eighteen months on average, the AP says.

A settlement route with conditions attached

The most practical part for a company under investigation is the "erkennings- en berustingsprocedure", a procedure of admission and acceptance. When the AP intends to fine, it may offer to end the case this way, and an organisation can ask for it through the case officer. There is no right to it: the AP decides whether the case suits it and whether it saves enough time.

Three conditions apply. The organisation must admit the breach described in the report and accept that it is the offender. It must accept the AP's fining method and the resulting fine, which means no objection, appeal or further appeal. And it must agree that the fine decision is published on the AP's website with a press release, which it may check only for factual errors. In return the AP lowers the fine by up to 35%. The talks are confidential, new information given during them stays out of the main case if they fail, and the route can be tried only once.

How a formal case runs

The policy sets out the steps under the Dutch general administrative law act. The organisation receives the investigation report, the documents behind it and the AP's intention to act, which names the kind of sanction but not yet an amount. It then gives a written view within a deadline the AP sets, may ask for more time with reasons, and may explain its view at a hearing. Cross-border GDPR cases go through the other EU authorities before a decision. Fines and penalty payments are collected by the CJIB, the central collection agency, and a GDPR fine is not collected while an objection or appeal is pending, so no interest runs in that time.

Where a decision is late, the AP will report progress at least every six months. An organisation that wants to end the breach early can bring a concrete plan to the case team, and if it has a data protection officer the officer's advice must be attached. Making such a proposal is not an admission, but the AP keeps the power to fine even when the breach stops.

What the AP can impose, and for how long

The instruments range from a reprimand, which can replace a fine where a fine would be disproportionate, through orders with a deadline and penalty payments, to a processing ban, withdrawal of a GDPR certification and an administrative fine. Under the Digital Services Act the AP can also make a commitment by an intermediary service binding, which removes the power to fine for that breach unless the commitment is broken. The power to fine lapses five years after a breach ends, and the AP gives keeping unlawfully processed data and failing to report a reportable breach as examples of breaches that continue until they are put right.

Besides the GDPR, the annex lists the Data Act, the Digital Services Act, eIDAS and the regulation on political advertising among the rules the AP enforces, and says the list will grow when Dutch legislation for the AI Act is in place.

From draft to final text

The AP published a draft on 13 April 2026 and received 12 responses, which it says made the policy clearer and more accurate. A separate accountability document explains how each was handled. Our GDPR compliance software category lists 11 products.

Sources

• Autoriteit Persoonsgegevens: Handhavingsbeleid AP gepubliceerd, 30 October 2026
• Autoriteit Persoonsgegevens: Handhavingsbeleid AP (policy text, PDF), 30 October 2026
• Autoriteit Persoonsgegevens: Verantwoordingsdocument (how the consultation responses were handled, PDF), 30 October 2026