Privacy and Data Protection

The GDPR (in Dutch the Algemene verordening gegevensbescherming, AVG) is the European Union law on the processing of personal data. It covers organizations established in the EU and also organizations elsewhere that offer goods or services to, or monitor, people in the EU. Maximum fines are €20 million or 4% of worldwide annual turnover, whichever is higher. In the Netherlands, the Autoriteit Persoonsgegevens (AP, the Dutch Data Protection Authority) supervises compliance; the Uitvoeringswet AVG adds Dutch details, for example on the citizen service number (BSN), which may only be used where a law allows it.

The United States has no single federal privacy law like the GDPR. Personal data is protected by a patchwork:

• Sector laws: HIPAA for health data held by health care providers, health plans and their business associates; the Gramm-Leach-Bliley Act (GLBA) for financial institutions; COPPA for online services that collect data from children under 13 (its rule was updated in 2025, with compliance required from 22 April 2026).
• The Federal Trade Commission (FTC) uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, against companies that break their own privacy promises or protect data carelessly.
• State laws: the California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA), applies to for-profit businesses that do business in California and have annual revenue above $25 million (adjusted for inflation), buy, sell or share the personal information of 100,000 or more California residents, or earn half their revenue from selling or sharing it. The California Attorney General and the California Privacy Protection Agency (CPPA, also called CalPrivacy) enforce it. Well over a dozen other states, such as Virginia, Colorado and Texas, have comprehensive privacy laws of their own, with similar ideas and different details.

The GDPR still applies to a US organization that offers goods or services to people in the EU or monitors them, and the UK GDPR does the same for people in the UK. The principles, lawful bases and roles below are GDPR concepts; US laws use other terms (the CCPA speaks of businesses, service providers and consumers) but many of the same ideas: notice, purpose limits, rights to access and delete, and reasonable security.

In the United Kingdom, the UK GDPR (the GDPR as kept in UK law after Brexit) and the Data Protection Act 2018, which adds UK details and exemptions, set the rules. The Data (Use and Access) Act 2025 amended both; most of its data protection changes took effect on 5 February 2026. Among them are "recognised legitimate interests" (a fixed list of purposes, such as crime prevention and safeguarding, that need no balancing test), wider room for automated decisions with safeguards, and some analytics and functionality cookies without consent. Maximum fines are £17.5 million or 4% of worldwide annual turnover, whichever is higher. The regulator is the Information Commission, which took over from the Information Commissioner's Office (ICO) on 30 September 2026 with the same role and powers; its guidance is on ico.org.uk. The concepts on the rest of this page are the same as in the EU GDPR.

A data protection officer (DPO; in Dutch functionaris gegevensbescherming, FG) is mandatory for public authorities and for organizations whose core activities involve large-scale, regular and systematic monitoring of people or large-scale processing of special categories of data or criminal-conviction data. The DPO must be able to work independently and reports to the highest level of management. In Dutch, the processor agreement is a verwerkersovereenkomst.

US law has no general duty to appoint a DPO, though many companies appoint a chief privacy officer anyway. HIPAA requires health care organizations to designate a privacy official and a security official. The written contract with a processor is required by sector and state laws: HIPAA calls the processor a business associate and the contract a business associate agreement (BAA); the CCPA requires a contract with every service provider or contractor that limits what it may do with the data.

Under the UK GDPR, the rules for a data protection officer (DPO) are the same as in the EU: mandatory for public authorities and for organizations whose core activities involve large-scale, regular and systematic monitoring of people or large-scale processing of special categories of data or criminal-offence data, independent, and reporting to the highest level of management. The written processor contract is required as well. In addition, organizations that use personal information must pay the regulator an annual data protection fee, unless they are exempt.

People can exercise rights over their data: to be informed, to access it (and get a copy), to rectification, to erasure ("the right to be forgotten", which has exceptions such as legal retention duties), to restriction of processing, to data portability, to object, and not to be subject to decisions based solely on automated processing with significant effects. The organization must respond without undue delay and within one month, extendable by two months for complex requests.

There is no general federal right to see or delete your data; the rights come from state and sector laws. The CCPA gives California residents the right to know what a business collects and how it is used, to delete, to correct, to opt out of the sale or sharing of their personal information, to limit the use of sensitive personal information, and not to be discriminated against for using these rights. A business must respond within 45 calendar days, extendable by another 45 days if it tells the consumer. HIPAA gives patients the right to access and amend their health records, and other state privacy laws give similar rights with their own deadlines.

The UK GDPR gives the same rights as the EU GDPR: to be informed, to access, to rectification, to erasure, to restriction, to data portability, to object, and rights around automated decisions. The deadline is one month, extendable by two months for complex requests. Searches need only be reasonable and proportionate (a rule the Data (Use and Access) Act 2025 wrote into law with effect from 1 January 2024). Since 5 February 2026 the clock starts only once the organization has the request and any proof of identity or fee it asked for, and it can be paused while the organization waits for a clarification it reasonably needs. Since 19 June 2026, organizations must also have a way to make a data protection complaint, acknowledge each complaint within 30 days and deal with it without undue delay.

Under the GDPR, a DPIA is required before such processing starts — for example large-scale processing of health data, systematic monitoring of a publicly accessible area on a large scale, such as camera surveillance, or profiling with significant effects on people. The Autoriteit Persoonsgegevens publishes a list of processing types for which a DPIA is always required. If a high risk remains, the authority must be consulted before starting.

No federal law requires a DPIA from private companies; federal agencies write privacy impact assessments (PIAs) under the E-Government Act of 2002. Several state privacy laws, such as Virginia's and Colorado's, require a data protection assessment before high-risk processing such as targeted advertising, selling personal data, processing sensitive data or profiling. In California, CPPA regulations in force since 1 January 2026 require risk assessments for processing that presents a significant risk, with a first summary due to the agency by 1 April 2028.

The UK GDPR has the same requirement as the EU GDPR: a DPIA before processing that is likely to be high-risk, such as large-scale processing of health data, systematic monitoring of public areas or profiling with significant effects. The UK regulator publishes its own list of processing types that need a DPIA, among them biometric and genetic data, tracking people and innovative technology. If a high risk remains, the regulator must be consulted before starting.

What the GDPR requires:

• The controller notifies the supervisory authority (in the Netherlands the Autoriteit Persoonsgegevens) without undue delay and where feasible within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people. Information may be supplied in phases if the investigation is still running; a late notification must explain the delay.
• When the breach is likely to result in a high risk — think of identity fraud, discrimination, or exposure of health data — the controller also informs the people affected, without undue delay, in clear language with advice on what they can do. This is not needed if, for example, the data was strongly encrypted and the key was not compromised.
• A processor informs its controller without undue delay; the controller does the notifying.
• Every breach is documented internally — facts, effects and measures taken — including the ones that did not need to be reported, so the decision can be checked later.

A breach can also be a security incident under other rules: an organization covered by NIS2 may have to report the same event to its cybersecurity authority within 24 hours (see Governance, Frameworks and Compliance).

US law usually defines a breach more narrowly, and who must be told depends on the data and the sector:

• State breach-notification laws exist in all 50 states, the District of Columbia, Guam, Puerto Rico and the US Virgin Islands. They typically cover unauthorized access to or acquisition of specific data, such as a name together with a Social Security number, a driver's license number or a financial account number, and often exempt encrypted data. You notify the affected residents under each state's law: some states say "without unreasonable delay", others set a fixed number of days, and many also require a notice to the state attorney general (in California when more than 500 residents are affected).
• HIPAA: a health care organization notifies the people affected without unreasonable delay and no later than 60 calendar days after discovering the breach. Breaches affecting 500 or more people also go to the Department of Health and Human Services (HHS) within that time, and to the media when more than 500 residents of a state are affected; smaller breaches are reported to HHS within 60 days after the end of the calendar year.
• Non-bank financial institutions report a breach of unencrypted customer information affecting 500 or more consumers to the FTC within 30 days of discovery (Safeguards Rule). Public companies disclose a material cybersecurity incident to the Securities and Exchange Commission (SEC) within four business days of deciding that it is material.
• A service provider or business associate informs the organization it works for, which does the notifying. Document every incident and why you did or did not notify; under HIPAA that documentation is required.

For critical infrastructure, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will require reports to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, and within 24 hours of a ransom payment, once CISA's final rule applies. That rule had not been published by early October 2026, so check its status.

What the UK GDPR requires (the same as in the EU):

• The controller notifies the regulator (the Information Commission, formerly the ICO) without undue delay and where feasible within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people. Report early and add details as the investigation goes on; a late notification must explain the delay.
• When the breach is likely to result in a high risk to people, the controller also informs them without undue delay, in clear language with advice on what they can do.
• A processor informs its controller without undue delay; the controller does the notifying.
• Every breach is documented internally, including the ones that did not need to be reported.

The same event can fall under other rules: operators of essential services report significant incidents under the NIS Regulations 2018 within 72 hours, and the Cyber Security and Resilience Bill, still before Parliament in October 2026, would add a first report within 24 hours. Telecom and internet providers have their own breach-reporting rule under the Privacy and Electronic Communications Regulations (PECR).

Dutch tax law, for example, requires businesses to keep their financial administration for seven years.

The IRS asks businesses to keep tax records generally for three years (six or seven in some situations) and employment tax records for at least four years. HIPAA requires its compliance documentation to be kept for six years, and the CCPA requires businesses to tell consumers, when they collect the data, how long they keep each category or how they decide.

A UK limited company, for example, must keep its company and accounting records for six years from the end of the last financial year they relate to, and longer in some cases.

Personal data may leave the European Economic Area only with appropriate safeguards: an adequacy decision of the European Commission for the destination country, standard contractual clauses (SCCs) with an assessment of the destination's laws, or binding corporate rules within a group. For the United States, the EU–US Data Privacy Framework (adopted in 2023) covers transfers to certified organizations. Earlier arrangements were struck down by the Court of Justice of the EU; the EU General Court upheld this one in September 2025, and an appeal to the Court of Justice was pending as of October 2026, so check its status at the time you rely on it. The United Kingdom has an adequacy decision, renewed in December 2025 and valid until 27 December 2031.

US law sets few general limits on sending personal data abroad. The exception is national security: data brokers may not make Americans' sensitive data available to foreign-adversary countries or companies they control (Protecting Americans' Data from Foreign Adversaries Act of 2024), and since 8 April 2025, a Department of Justice rule (28 CFR part 202) prohibits or restricts transactions that give countries of concern (China, Cuba, Iran, North Korea, Russia and Venezuela) access to bulk sensitive personal data or government-related data. In the other direction, a US organization that receives personal data from Europe usually relies on the Data Privacy Framework (DPF): it self-certifies with the Department of Commerce and commits to the framework's principles, which the FTC (or, for airlines, the Department of Transportation) can enforce, and can also join the UK Extension and the Swiss–US framework. Otherwise the European sender uses standard contractual clauses or the UK equivalents. The EU decision behind the DPF was upheld by the EU General Court in September 2025; an appeal to the Court of Justice was pending as of October 2026, so check its status.

Personal data may leave the UK to countries covered by UK adequacy regulations, which the government calls data bridges: among others the EEA countries and, through the UK Extension to the EU–US Data Privacy Framework (since 12 October 2023), certified US organizations. Otherwise it needs appropriate safeguards — the International Data Transfer Agreement (IDTA), the UK Addendum to the EU standard contractual clauses, or binding corporate rules — with a transfer risk assessment. Since 5 February 2026, the Data (Use and Access) Act 2025 sets the test: protection after the transfer must not be "materially lower" than in the UK. In the other direction, the EU renewed its adequacy decision for the UK in December 2025, valid until 27 December 2031, so data flows freely from the EU to the UK.