Drone Rules in the Netherlands: Registration, No-Fly Zones and the AVG

A drone with a camera is two things at once under Dutch law. It is an unmanned aircraft, governed by the European aviation rules that apply in every EU Member State, and it is a device that records personal data, governed by the AVG (Algemene verordening gegevensbescherming, the Dutch name for the GDPR).

Those two regimes set different thresholds, ask different questions and are enforced by different authorities. Satisfying one of them says nothing at all about the other, which is the point most drone guidance leaves out.

Information last verified on 21 July 2026. This page provides general legal information about Netherlands law and does not constitute legal advice in an individual case.

Two rulebooks, one flight

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, states the interaction more plainly than the aviation guidance does. Under the heading Voorbeeld: wel veilig, niet AVG-proof, in guidance updated on 31 December 2024, it makes the point that the aviation rules do not prohibit a flight over a residential area with a drone lighter than 900 grams, but that the AVG applies alongside them and the weight of the drone makes no difference to that. In its own words:

Volgens de regelgeving voor de luchtvaart is het niet verboden om met een drone boven een woonwijk te vliegen, als de drone lichter is dan 900 gram. Volgens de luchtvaartregelgeving is dat veilig genoeg. Maar als het gaat om de privacy van mensen, geldt naast die regelgeving ook de Algemene verordening gegevensbescherming (AVG). Hoe zwaar of licht de drone is, maakt daarbij niet uit.

A flight can therefore be entirely correct in aviation terms and still be a data protection problem, and a drone that films nothing identifiable can still breach the aviation rules on altitude, distance or restricted airspace.

The three categories

Uitvoeringsverordening (EU) 2019/947 divides all drone flights into three risk categories, and the Dutch government applies them without a national variation.

Artikel 4 of the regulation sets the conditions that keep a flight in the open category, and all of them have to hold at once: the aircraft is in one of the class categories or is privately built, its maximum take-off mass is under 25 kg, the pilot keeps a safe distance from people and never flies over an assembly of people, keeps the drone in visual line of sight, stays within 120 metres of the nearest point of the earth's surface, and carries no dangerous goods and drops nothing. Fail any one of them and the flight belongs in the specifieke category.

Rijksoverheid restates those as day-to-day rules and adds one of its own: do not fly at night. That last line is the government's citizen guidance rather than a prohibition in the regulation, which instead regulates night flight. Under UAS.OPEN.060(2)(g) of the consolidated text of 2019/947, a remote pilot operating at night has to make sure a green flashing light on the aircraft is switched on, a point that has applied since 1 July 2022.

The minimum remote pilot age is 16 under artikel 9 lid 1, subject to narrow exceptions in lid 2, one of which is flying under the direct supervision of a pilot who does meet the requirement.

Cx labels and the open subcategories

Cx labels have been mandatory since 1 January 2024. The label determines which open subcategory a drone may be flown in and what training the pilot needs. Anything written about the open category before 2024 describes the transitional regime that has now ended.

The subcategories then set the distances. In A1 the pilot must not overfly an assembly of people, and with a C1 aircraft must also reasonably expect not to overfly uninvolved persons. In A2 the pilot must not overfly uninvolved persons and must keep a horizontal distance of at least 30 metres from them, which may be reduced to a minimum of 5 metres only where the aircraft's low-speed mode is active and only after evaluating the weather conditions, the performance of the aircraft and the area being overflown. In A3 the flight takes place where no uninvolved person is reasonably expected to be endangered, at a safe horizontal distance of at least 150 metres from residential, commercial, industrial or recreational areas.

Remote ID, which broadcasts by wifi or bluetooth who the drone belongs to and where the pilot is, is required for C1, C2 and C3 labels and in the specifieke category. Rijksoverheid names C0 and C4 as the exceptions.

Registration: what actually triggers it

This is the rule most often stated wrongly, usually as a single condition about weight and a camera. It is not one condition. Artikel 14 lid 5 of Uitvoeringsverordening (EU) 2019/947 requires an operator to register itself where, in the open category, it operates an unmanned aircraft that:

• has an MTOM (maximum take-off mass) of 250 grams or more, or, in a collision, can transfer more than 80 joules of kinetic energy to a person; or
• is fitted with a sensor able to record personal data, unless the aircraft complies with toy directive 2009/48/EG.

In the specifieke category, an aircraft of any mass must be registered.

The regulation introduces those two points as one of the following, so each is an independent trigger and one is enough. A drone of 180 grams with an ordinary camera is registrable on the sensor limb alone, whatever it weighs, and a heavy drone with no camera at all is registrable on the weight limb alone. Reading the rule as a combined test is what leads someone to conclude that a light camera drone is exempt, and rijksoverheid states directly that a fine can follow where someone who has to register does not.

How it works in the Netherlands

Rijksoverheid applies the same rule from the other end, listing only two exemptions: the drone is lighter than 250 grams and has no camera, or it is lighter than 250 grams and has a camera but is a toy drone, which must be clearly marked as such on its packaging. Its own summary is blunt: you do not have to register the drone, unless your drone has a camera, in which case you do.

You register with the RDW and receive an operator registration number (exploitantnummer). That number goes visibly on the drone as a plate, sticker or QR code, and the number and the serial number also go digitally into the drone's software as Remote ID, except for C0 and C4 labels where the visible marking is enough.

Three practical points follow from the RDW's own rules. The exploitantnummer is valid for one year and has to be renewed. If you lend your drone to someone else, that person needs their own exploitantnummer and must put their own number on the aircraft, and the pilot is responsible for the flight and for any damage it causes. A business registers once as the company, using eHerkenning, and puts the same number on every company drone.

The RDW is also the body that issues and renews the remote pilot certificate (vliegbewijs) for drones from 250 grams, and that handles stopping one.

Where you may not fly

Two places in the Netherlands are closed to every drone regardless of category: palaces and buildings of the Koninklijk Huis, and the protected nature areas above the Waddenzee.

For open-category flights, rijksoverheid publishes a further list of areas that are prohibited or restricted: government buildings; military areas and training areas; events and other temporarily cordoned areas; roads with a speed limit of 80 km per hour or higher; railway lines; areas around airports; some Natura 2000 areas, as determined by the province or site manager; hospital helipads; high-voltage cables; drinking-water areas; large seaports; sites handling hazardous substances; secured sites; areas where emergency services are operating; and low-flying routes and areas.

Low-flying routes carry a partial exception: drones are still allowed there up to 30 metres above the ground if they are A1 and at most 250 grams, or A2 and at most 4 kilograms. For a specifieke-category flight the permitted area is set out in the exploitatievergunning itself.

The statutory hook for these zones is artikel 15 of 2019/947 on geographical UAS zones, and the national layer sits in the Regeling onbemande luchtvaartuigen, the Regeling Modelvliegen and the Regeling op afstand bestuurde luchtvaartuigen. The maps are the Aeret Kaartviewer, a downloadable ISON file that some drones can read directly, and the GoDrone app. Rijksoverheid warns that the situation on the ground can differ from what the maps show, so cables, cranes, high objects, groups of people and other air traffic still have to be checked in person.

What the AVG adds once the camera is on

Once a camera films the public road or a neighbour's property, the activity is no longer a purely personal or household one, so the AVG applies and the person filming needs a lawful basis, in practice the gerechtvaardigd belang in artikel 6 lid 1 onder f AVG, together with necessity and a balancing of interests. Falling outside the household exemption does not by itself make the camera unlawful; it means the AVG governs it. The gerechtvaardigd belang is the legitimate interest basis, one of the six grounds (grondslagen) in artikel 6 AVG.

For a drone the boundary has not been drawn by a court. The Autoriteit Persoonsgegevens does not say that the household exemption can never apply to a hobby flight, and its own starting question is whether the drone is processing personal data at all. Where a flight goes beyond the operator's own private sphere, the reasoning that applies is the reasoning in Ryneš, by analogy, and not a decided drone case.

The same analysis is set out for fixed cameras on neighbour security cameras, and the AVG's general scheme and the AP's powers are covered on the AVG in the Netherlands. Which body decides which privacy question, across all of this, is mapped on privacy law in the Netherlands.

The AP's own examples for drones are worth reading in full, because they show how low the threshold for personal data actually sits. Police filming from a height how a crowd moves, without zooming, where people are not recognisable and not otherwise identifiable, processes no personal data. A drone filming the houses in a residential street usually does process personal data even if no resident appears in shot, because the operator knows where the drone was flying and the drone commonly records location data too, from which the residents are relatively easy to identify.

Two further AP examples turn on the basis rather than on identification. A factory owner inspecting chimneys who records video for the whole flight rather than only over the chimneys fails on data minimisation, because people come into shot unnecessarily. And in guidance updated on 31 December 2024, the AP notes that the party which decided to deploy the drone is the verwerkingsverantwoordelijke (the controller), which it says applies to private individuals as much as to public bodies.

The AP also flags the duty to inform, under artikel 14 read with artikel 13 AVG. People who may be filmed have to be informed before it happens, which is genuinely awkward with a moving aircraft, so the AP suggests signs at the edges of the flight area, an announcement on the controller's website or in local media, leaflets handed out on site, and making the drone conspicuous with bright colours, flashing lights or sound.

The AP adds that the duty falls away in limited cases, among them where the people concerned already know about the cameras and where informing them proves impossible or would take a disproportionate effort under artikel 14 lid 5 onder b AVG. It recommends informing in any event, and points out that not being able to inform makes the intrusion greater and can therefore make the flight disproportionate. It also observes that drones are less likely than fixed cameras to satisfy subsidiarity and proportionality, precisely because they can be moved anywhere.

Separately from the AVG, a camera whose presence has not been made clearly known can engage the criminal provisions on covert images, artikel 139f Sr where the person filmed is in a home or another place not open to the public and artikel 441b Sr where the place is open to the public, which is one reason the Autoriteit Persoonsgegevens tells camera owners to signpost the camera; see recording conversations.

Who enforces which part

Registration is the one place where the two regimes visibly meet, because a drone becomes registrable in part on the ground that it carries a sensor able to record personal data. That is an aviation rule written in data protection terms, and a useful reminder of which feature of the aircraft brings the AP into the picture.