Complaint to the Autoriteit Persoonsgegevens: Tip, Klacht and the Faster Route

A complaint (klacht) to the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, is free, can be filed in Dutch or in English, and is the route most people are pointed to when an organisation mishandles their personal data. It is also slower and narrower than most readers expect, and for one very common problem it is not the route the AP itself recommends.

Two decisions come before the form. The first is whether the situation calls for a tip, a klacht or a datalektip, because those three differ in anonymity, in the evidence required and in whether anyone writes back to you. The second is whether the AP is the right instrument at all, because where an organisation has refused or ignored an access request (inzageverzoek) the AP itself points to a court route that runs on a six-week clock rather than a six-month one.

Information last verified on 21 July 2026. This page provides general legal information about Netherlands law and does not constitute legal advice in an individual case.

Tip, klacht or datalektip: choose before you open the form

The AP runs one form with three entry points, and the choice changes what happens next. It is the most consequential decision in the whole procedure and it is made in the first minute.

Anonymity is the trade-off, and it runs in one direction. A klacht is about your own personal situation, so the AP discloses your identity to the organisation and shares a copy of the complaint and of its decision with them, which the Algemene wet bestuursrecht (Awb) requires. Someone who cannot accept that disclosure is choosing a tip, and a tip brings no personal answer about what the AP did with it.

One routing rule is worth knowing in advance: if a complaint turns out not to be about the complainant's own personal data, the AP does not reject it but converts it into a tip at the preliminary stage (vooronderzoek) and handles it that way.

What the AP requires before it will handle a complaint

The AP expects the person concerned (betrokkene) to have approached the organisation first and given it a chance to solve the problem, either by complaining to the organisation itself or by making a request such as an inzageverzoek. Its wording is unambiguous: if you have not done that, the complaint is not handled.

Proof of that step is part of the filing: a copy of the email or letter you sent, the organisation's reply, or the reply of its functionaris gegevensbescherming (FG, the data protection officer), together with the evidence of the suspected breach itself, such as screenshots. The AP states that a complaint sent without enough evidence cannot be handled.

One unusual instruction sits alongside it in guidance updated 18 April 2025. If generative AI is used to draft the submission, the AP asks that the output be checked, because a text that is unnecessarily long or unintelligible risks not being taken into handling at all.

How to file, and what to put in it

The online form is the main route, and the AP recommends filling it in on a computer rather than a phone. A privacy complaint may also be sent by letter, to Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, in Dutch or in English.

A letter should state which personal data are involved, which organisation it concerns, whether a complaint was already made to that organisation and how it responded, whether the processing or its harmful effect is still ongoing, what the complaint is meant to achieve, and the sender's name, address and telephone number. Filing costs nothing, because AVG artikel 57 lid 3 requires every supervisory authority to carry out its tasks free of charge for the person concerned.

Someone else may file on your behalf, including an advocaat, Het Juridisch Loket or an interest organisation, and the authorisation (machtiging) is attached to the submission. An earlier tip or complaint can be amended or withdrawn through the same form, for example once further evidence exists or the matter has been resolved.

What the AP does with a complaint

After the vooronderzoek, most complaints are resolved without an investigation: the AP may explain what the complainant can do themselves, telephone the organisation or send it a waarschuwingsbrief, approach its FG or its trade body, or mediate between the two sides. Its own worked example is the common one, a company that does not respond to a request for access, where the AP can order the organisation to respond after all and says this often leads directly to a solution. Complaints are also sometimes bundled with similar ones, or folded into an investigation already running on that subject, so a file can go quiet without being dropped.

Whether a complaint receives an extensive investigation (uitgebreid onderzoek) is a prioritisation decision, and the AP publishes the criteria: how serious the intrusion on privacy is, whether the possible breach is still ongoing, its impact on society, whether the AP has enough scope to act against that organisation, and whether the subject falls within a theme in the AP's jaarplan. An infringement that has already stopped weighs against further investigation.

In the few cases that go further, the AP tells the organisation what it is investigating and why, requests written information, and may carry out an onderzoek op locatie, inspecting systems and questioning directors and staff. It then produces an onderzoeksrapport, the organisation replies with a zienswijze which can still change that report, and only afterwards does the AP decide on measures. If it finds a breach, the ladder runs from an invitation to a conversation, a berisping (reprimand), verscherpt toezicht (enhanced supervision), a last onder dwangsom (an order backed by a penalty payment) or a verwerkingsverbod (a processing ban), up to a fine within the AVG maxima, which are set out on the AVG in the Netherlands.

The three timelines, and why they are not one timeline

Three separate periods are in circulation and they are routinely merged into a single wrong sentence. They measure different things and none of them is a deadline for a decision.

The practical reading is that contact is tightly scheduled and a substantive result is not. AVG artikel 77 lid 2 obliges the authority to inform the complainant of the progress and the outcome and of the judicial remedy in artikel 78; it does not set a date by which the outcome must exist.

The faster route when a company refuses an access request

This is the point at which the AP tells complainants to go somewhere else, and it says so twice on its own filing page. It is the single most useful thing to know before filing.

Three Dutch words carry the route. A verzoekschrift is an application to a court, as opposed to a claim brought by writ. The rechtbank is the district court. The bestuursrechter is the administrative court, which is where an objection against a government body ends up.

Where a company refuses or ignores a request under artikelen 15 tot en met 22 AVG, artikel 35 van de Uitvoeringswet AVG allows the person concerned to apply to the rechtbank by verzoekschrift for an order that the request be granted or refused, within six weeks of the company's answer, and with no time limit at all if the company did not answer within the artikel 12 lid 3 periods. Artikel 35 lid 4 provides that the verzoekschrift does not have to be submitted by an advocaat. The Autoriteit Persoonsgegevens points to this route as the faster one. Where the organisation is a government body, the route is bezwaar and then beroep to the bestuursrechter under artikel 34 van de Uitvoeringswet AVG.

The artikel 12 lid 3 period referred to there is one month from receipt of the request, which the controller (verwerkingsverantwoordelijke) may extend by a further two months where the request is complex or numerous, provided it notifies the person within the first month. Silence past those periods is what removes the six-week limit, so an organisation that never replied at all leaves the artikel 35 route open indefinitely.

Artikel 36 UAVG adds a bridge between the two routes. Within the artikel 35 lid 2 period, or within the period for lodging an administrative beroep, the person concerned may instead ask the AP to mediate or advise in the dispute, or use a dispute-resolution scheme under an approved code of conduct. The artikel 35 application can then still be brought after the AP reports that its handling has ended, and at the latest six weeks after that point.

Where the complaint concerns a camera dispute with neighbours, the AP says on its own filing page that taking steps yourself is the better first move, and those steps are set out on neighbour security cameras.

What a complaint can and cannot deliver

What a complainant can realistically expect is an assessment of every complaint, contact within three months, and in the common access-refusal case an instruction to the organisation to respond. Those outcomes are real and they are the ones that resolve most files.

What a complaint does not deliver is money. The Autoriteit Persoonsgegevens supervises and enforces, but it does not award damages to an individual. Compensation for a privacy breach is a civil claim under artikel 6:162 BW, brought before the civil court and decided on its own evidence.

Nor does it deliver anonymity, a guaranteed investigation, or speed. Even a complaint that succeeds ends in a measure against the organisation, and a fine imposed by the AP is payable to the State rather than to the person who complained. Whether a recording or a document can be used to prove a privacy breach in the civil court is a separate question, dealt with on recordings as evidence, and which body can give which remedy is mapped on privacy law in the Netherlands.

Disagreeing with the outcome

Both the complainant and the organisation can lodge bezwaar (an administrative objection) against the AP's decision on the complaint. The period is six weeks, running from the day after the date on the decision letter, which itself states whether bezwaar is open and how to lodge it. The AP then has six weeks to respond and may extend that by six weeks where necessary, and further after that.

If the decision on the bezwaar is still unsatisfactory, beroep lies to the bestuursrechter (the administrative court), and the AP confirms that this can be done without an advocaat. The organisation the report concerns has the same right of appeal.

Complaints about an organisation based outside the Netherlands

Where the organisation's European head office is in the Netherlands, the AP handles the complaint itself. Where it is elsewhere, the AP passes the case to the supervisory authority of that country while remaining the complainant's point of contact, and it notes that an internationally handled case can take longer. The right to complain is not affected: AVG artikel 77 lid 1 allows a complaint in the Member State of habitual residence, of the workplace, or of the alleged infringement.

Frequently Asked Questions

How long does the Autoriteit Persoonsgegevens take to handle a complaint?

Three periods have to be kept apart. The AP publishes an average of about six months before it can take a complaint into handling at all. Once filed, you receive a bericht about the complaint within three months, which is a progress notification rather than a decision. If the AP cannot report a result by then, its text is that a further letter follows at the latest within six months after that message, so a second update can arrive roughly nine months after filing.

Can I complain to the AP anonymously?

No. A privacy complaint is about your own personal situation, so the AP asks for your personal details and discloses your identity to the organisation the complaint concerns, sharing a copy of the complaint and of its decision with them under the Algemene wet bestuursrecht. Someone who does not want that disclosure can submit a tip instead, which may be anonymous but brings no personal reply.

Do I have to contact the company first before complaining to the AP?

Yes. The AP expects the person concerned to have approached the organisation first, either by complaining to it or by making a request such as an inzageverzoek, and states that a complaint is not handled where that step has not been taken. Proof of the contact goes in with the filing, such as the email or letter sent, the organisation's reply, or the reply of its functionaris gegevensbescherming.

Does a complaint to the AP get me compensation?

No. The AP supervises and enforces, but it does not award damages. Compensation is a civil claim under artikel 6:162 BW, brought before the civil court and decided on its own evidence. A fine imposed by the AP is payable to the State, not to the person who complained.

What is faster than a complaint if a company refuses to give me access to my data?

Where a company refuses or ignores a request under artikelen 15 tot en met 22 AVG, artikel 35 van de Uitvoeringswet AVG allows a verzoekschrift to the rechtbank for an order that the request be granted or refused, within six weeks of the company's answer and with no time limit at all if the company never answered within the artikel 12 lid 3 periods. Artikel 35 lid 4 provides that it does not have to be submitted by an advocaat, and the AP itself points to this route as the faster one. Against a government body the route is bezwaar and then beroep to the bestuursrechter under artikel 34 van de Uitvoeringswet AVG.

Will the AP investigate my complaint?

Not necessarily in full. Most complaints are resolved without an extensive investigation, through contact with the organisation, a warning letter, mediation, or an instruction to respond to a request that was ignored. Whether a file goes further is a prioritisation decision against published criteria: the seriousness of the intrusion, whether the possible breach is still ongoing, its impact on society, the AP's scope to act against that organisation, and whether the subject falls within a theme in its jaarplan.

What can I do if I disagree with the AP's decision on my complaint?

Bezwaar can be lodged with the AP within six weeks, counted from the day after the date on the decision letter. The AP has six weeks to respond and may extend that period by six weeks where necessary, and further after that. If the decision on the bezwaar is still unsatisfactory, beroep lies to the bestuursrechter, which the AP confirms can be done without an advocaat.

What is the difference between a tip and a datalektip?

A tip is used where there is a strong suspicion that an organisation or person is not complying with privacy law, and it can be about anyone's data, including someone else's. A datalektip is used where the suspicion is specifically that a data breach has occurred at an organisation, or that a breach was badly handled, and the AP asks that the organisation itself be told first so that it can take measures. Neither route brings a personal reply about what the AP did with it.