Privacy Law in the Netherlands: the AVG, the AP and the Right Route

Dutch privacy law is not one statute. Most of it is European law applied directly in the Netherlands: the Algemene verordening gegevensbescherming (AVG), which is the Dutch name for the General Data Protection Regulation. The national layer on top of it is the Uitvoeringswet AVG (UAVG), which constitutes the supervisory authority and exercises the choices the regulation left to each Member State.

Around that sit the other bodies of law that decide real privacy disputes here. The Wetboek van Strafrecht (Sr) makes certain covert recordings and covert images criminal offences, the law of unlawful act (onrechtmatige daad) in artikel 6:162 BW carries the civil claim, and sector rules such as the European aviation rules govern where a drone may fly.

This page is the map rather than the answer. It sets out what Dutch privacy law consists of, which body decides which question, and which of the guides below deals with the question you actually have.

Information last verified on 21 July 2026. This page provides general legal information about Netherlands law and does not constitute legal advice in an individual case.

What Dutch privacy law is made of

The AVG is a regulation, so it applies in the Netherlands of its own force and is not rewritten into Dutch law. It supplies the vocabulary every other page in this section uses: a verwerkingsverantwoordelijke (controller) decides why and how personal data are processed, a betrokkene (data subject) is the person the data are about, and every processing needs a grondslag, a lawful basis, from the list in artikel 6 lid 1 AVG.

The Uitvoeringswet AVG is short and does not restate the AVG. It constitutes the Autoriteit Persoonsgegevens (AP), makes the Dutch choices on the points the regulation left open, and builds the route from a refused request to a Dutch court. Those national choices are the reason a Dutch privacy question is not answered by a general explanation of the regulation, and they are set out on the AVG in the Netherlands.

Criminal law runs on its own track. Artikel 139f Sr punishes a person who, using a technical device whose presence has not been made known in a clear manner, deliberately and unlawfully makes an image (afbeelding) of a person present in a home or another place not open to the public, and artikel 441b Sr is the counterpart provision where the person filmed is in a place that is open to the public. The criminal provisions on recording a conversation, and how the criminal and data protection questions differ, are on recording conversations.

Civil law carries everything the AP cannot do. Artikel 6:162 BW makes an intrusion into private life an unlawful act where the conditions are met, and a civil court can order a camera moved or removed as well as award compensation.

When the AVG engages, and what that does and does not mean

Two statements decide most private disputes, and they are easy to get backwards.

Artikel 4 lid 2 AVG counts collection and recording as processing, so the AVG engages when the recording is made rather than when it is shared. What removes most private recordings is not the absence of publication but the exemption in artikel 2 lid 2 onder c AVG for a purely personal or household activity.

The second statement follows from the first. Once a camera films the public road or a neighbour's property, the activity is no longer a purely personal or household one, so the AVG applies and the person filming needs a lawful basis, in practice the gerechtvaardigd belang in artikel 6 lid 1 onder f AVG, together with necessity and a balancing of interests. Falling outside the household exemption does not by itself make the camera unlawful; it means the AVG governs it.

The practical consequence is that a household camera question is rarely a yes or no question. It is a question about where the camera points, what it keeps, who is told about it, and whether the owner's interest outweighs the interests of the people in frame. That test, and the conditions the AP sets for a camera that unavoidably catches a strip of public road, are on a neighbour's security cameras.

Which body decides what

The Netherlands is a unitary state and these rules are national, so the question is never which province or gemeente you are in. It is which body has the power to give you what you are asking for.

The line that matters most in that table is the first one against the second. The Autoriteit Persoonsgegevens supervises and enforces, but it does not award damages to an individual. Compensation for a privacy breach is a civil claim under artikel 6:162 BW, brought before the civil court and decided on its own evidence.

A complaint and a civil claim are therefore not alternatives that lead to the same place. A complaint can produce a measure against an organisation; only a court can order a specific thing to happen in the complainant's favour or award money. Choosing the route by what you want, rather than by which form is easiest to find, is the single most useful decision on this subject.

Where each question goes

Four guides sit under this section, and each one answers a different kind of question.

• The AVG in the Netherlands. What the Uitvoeringswet AVG does that the regulation does not, how the Autoriteit Persoonsgegevens is constituted and what it can actually do, the rights in artikelen 15 tot en met 22 AVG and the deadline that runs on them, and the duty to report a data breach (datalek). Start here for an organisation's obligations or for your own rights against one.
• A neighbour's security cameras. The household exemption and the case law behind it, when a doorbell or garden camera falls outside it, the conditions the AP sets when a camera unavoidably reaches the public road, and the civil route against a camera that will not be moved. Start here for a camera on a house, yours or someone else's.
• Complaining to the Autoriteit Persoonsgegevens. The difference between a tip, a klacht and a datalektip and what each one costs you in anonymity, evidence and speed, what the AP does after you file, how long it realistically takes, and the faster route to the rechtbank where the problem is a refused access request. Start here when an organisation will not fix something.
• Drone rules. The open, specifieke and gecertificeerde categories, the Cx labels, when an operator must register with the RDW and get an exploitantnummer, where a flight is not allowed, and the AVG layer that applies on top whenever the drone carries a camera. Start here before flying, and note that satisfying the aviation rules is not the same as satisfying the AVG.

The rest of the Dutch legal map

Recording is the other half of this subject and has its own section. The criminal provisions on capturing a conversation or an image, and the separate question of what may be done with a recording afterwards, are on Netherlands recording laws, with the detail on recording conversations and on recordings as evidence.

For the European frame around the AVG rather than the Dutch application of it, see EU data privacy laws. A shorter country-level summary written as part of the worldwide privacy survey is at the Netherlands entry, and the wider Dutch legal map is on the Netherlands law overview.

Frequently Asked Questions

What is the privacy law in the Netherlands?

There is no single Dutch privacy statute. The main instrument is the Algemene verordening gegevensbescherming (AVG), the Dutch name for the General Data Protection Regulation, which applies directly in the Netherlands. The Uitvoeringswet AVG (UAVG) adds the national layer: it constitutes the Autoriteit Persoonsgegevens, exercises the choices the regulation left to each Member State and builds the Dutch route to a court. Criminal provisions in the Wetboek van Strafrecht and the civil law of onrechtmatige daad in artikel 6:162 BW sit alongside it.

Who is the data protection authority in the Netherlands?

The Autoriteit Persoonsgegevens, usually shortened to AP. Artikel 6 van de Uitvoeringswet AVG constitutes it and designates it as the supervisory authority for the purposes of the AVG. It handles tips, complaints and data breach reports, investigates, and can impose corrective measures on an organisation.

Can the Autoriteit Persoonsgegevens award compensation?

No. The AP supervises and enforces, but it does not award damages. Compensation is a civil claim under artikel 6:162 BW, brought before the civil court and decided on its own evidence. That is why a reader who wants money, or an order that a particular use of their data stop, is looking at a civil claim rather than at a complaint.

Is it illegal for a camera to film the public road in the Netherlands?

Not automatically, and this is the most common misreading. Falling outside the household exemption does not by itself make the camera unlawful; it means the AVG governs it, so the person filming needs a lawful basis, in practice the gerechtvaardigd belang in artikel 6 lid 1 onder f AVG, together with necessity and a balancing of interests. The Autoriteit Persoonsgegevens publishes the conditions it expects a home camera to meet in that situation.

Where do I complain about a company using my personal data?

To the Autoriteit Persoonsgegevens, which takes a tip, a complaint (klacht) and a data breach tip through separate routes with different consequences for anonymity, evidence and speed. The AP expects contact with the organisation itself first. Where the issue is a refused or ignored request under artikelen 15 tot en met 22 AVG, artikel 35 van de Uitvoeringswet AVG offers a route to the rechtbank that the AP itself describes as the faster one.

Do drone rules and privacy rules work separately in the Netherlands?

Yes, and that is the point most drone owners miss. The European aviation rules decide the category, the registration and the places a flight is allowed, supervised in the Netherlands by the ILT and the RDW. Whether the drone may film identifiable people is a separate question under the AVG, supervised by the Autoriteit Persoonsgegevens, so a flight that is safe under the aviation rules can still be a data protection problem.

Which court hears a Dutch privacy claim?

A claim to stop, remove or reposition something, or a claim for compensation under artikel 6:162 BW, is a civil claim, and artikel 93 Rv decides whether it goes to the subdistrict court (kantonrechter) or to the district court (rechtbank). A request under artikel 35 van de Uitvoeringswet AVG about a refused data request against an organisation that is not a government body goes to the rechtbank by verzoekschrift. A decision of a government body, and a decision of the AP itself, is challenged by bezwaar and then beroep to the bestuursrechter.