Autoriteit Persoonsgegevens (Dutch DPA)

What Autoriteit Persoonsgegevens (Dutch DPA) does

The Autoriteit Persoonsgegevens (AP) is the independent Dutch supervisory authority for data protection, headquartered in The Hague and operating under the AVG/GDPR framework. Established in its current form on 25 May 2018 when the GDPR came into force (succeeding the College bescherming persoonsgegevens, or CBP), the AP enforces Dutch and EU privacy law by supervising organizations that process personal data, handling citizen complaints and data breach notifications, conducting investigations, imposing administrative fines, and publishing compliance guidance and educational materials. It also handles coordinated vulnerability disclosures for its own ICT systems through a public CVD (Coordinated Vulnerability Disclosure) process.

In 2023, the AP established the Directie Coördinatie Algoritmes (DCA) to coordinate oversight of algorithms and AI systems in the Netherlands, publishing semi-annual Rapportage AI & Algoritmes Nederland (RAN) reports and advising the Dutch government on AI-verordening (the EU AI Act) implementation. Core "products" are public information services rather than commercial offerings: the AP-nieuwsbrief newsletter, an online Datalek Melden (data breach reporting) portal, a Klacht Indienen (complaint filing) portal, 21 voorbeeldbrief templates for citizens exercising privacy rights, a 5-stappenplan AVG (five-step GDPR compliance plan) for entrepreneurs, and a public web archive maintained in partnership with Archiefweb since January 2022. Technology infrastructure includes secure email via SecuMailer, the public website at autoriteitpersoonsgegevens.nl, and adherence to BIO (Baseline Informatiebeveiliging Overheid, the Dutch government baseline for information security) and NIS2 (the EU Network and Information Security Directive 2) standards.

The AP is funded through the Dutch national budget rather than commercial revenue, and it charges no fees for its services. All services are free to citizens and organizations, with GTM (go-to-market) activity limited to public communications, guidance documents, and LinkedIn/newsletter outreach. The organization is structured horizontally across four primary segments: citizens (Burgers), organizations (Organisaties), government bodies (Overheidsorganisaties), and AI/algorithm users. Strategic priorities for 2026-2028 are mass surveillance, AI, and digital resilience.

Name

Autoriteit Persoonsgegevens (Dutch DPA)

Legal name

Autoriteit Persoonsgegevens

Website

https://autoriteitpersoonsgegevens.nl

Company type

Private

Founded year

2018

Operating status

Operating

Headcount range

251–500 employees

Short description

The Autoriteit Persoonsgegevens is the independent Dutch Data Protection Authority, enforcing GDPR compliance for citizens and organizations across the Netherlands, with expanding AI and algorithm oversight through its DCA directorate.

Ownership category

akta.pro rank

Product category

Data Protection Regulatory Authority

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615), Public Administration (92)

akta.pro primary industry

Privacy Governance & Consent Management (HDADAIAI)

Keywords

• Data protection supervision
• Privacy regulatory enforcement
• GDPR compliance guidance
• Data breach notification services
• Algorithm AI oversight

Headquarters

HQ city

The Hague, South Holland

HQ country

Netherlands

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Infrastructure

Revenue model

1. Government Funding: The AP is funded by the Dutch government as a regulatory authority. The organization receives budget for its activities including €1 million from 2023, increasing to €3.6 million annually by 2026 for the Directie Coördinatie Algoritmes (DCA) activities.

Go-to-market motion1 record

Distribution channels3 records

Marketing channels7 records

Core offering

The Autoriteit Persoonsgegevens (AP) is the Dutch independent supervisory authority that oversees and enforces compliance with the AVG (GDPR). It supervises organizations and government bodies that process personal data, receives and processes data breach notifications and privacy complaints, conducts investigations, imposes fines and remedial orders, and provides free public guidance, template letters, and educational materials to citizens and organizations on their privacy rights and obligations.

Product overview

The Autoriteit Persoonsgegevens (AP) is the Dutch Data Protection Authority, functioning as the independent supervisory body for GDPR compliance in the Netherlands. The AP operates as a unified regulatory authority rather than a commercial product company. Its digital offerings consist of government information services including: data breach reporting and complaint filing portals, the AP newsletter subscription service, template letter resources for privacy rights, guidance documents (5-step GDPR plan, privacy statement guidance), and the Directie Coördinatie Algoritmes (DCA) unit for algorithmic/AI oversight. The AP also provides public web archiving and coordinated vulnerability disclosure services. All services are free public services supporting the AP's regulatory mission rather than commercial product offerings.

Differentiator

Problem solved

Functional benefit

Products and services

• AP-nieuwsbrief (AP Newsletter) Email newsletter service providing regular updates on GDPR/AVG developments, AP activities, and privacy-related news to subscribers.
• Datalek Melden (Data Breach Reporting) Online portal for organizations to report data breaches to the AP as required by the GDPR/AVG.
• Klacht Indienen (Complaint Filing) Online service for citizens to file privacy complaints and tips regarding potential AVG/GDPR violations.
• Directie Co\u00f6rdinatie Algoritmes (DCA) Directorate for Algorithm Coordination coordinating algorithmic and AI oversight in the Netherlands, publishing semi-annual RAN reports on AI and algorithm risks and preparing for the AI-verordening.
• Voorbeeldbrieven (Template Letters) Free collection of template letters (21 documents) helping citizens exercise their privacy rights including access, rectification, deletion, and data portability requests.
• 5-Stappenplan AVG (5-Step GDPR Plan) Step-by-step plan for entrepreneurs to achieve basic GDPR/AVG compliance, including guidance on hiring employees.
• Kwetsbaarheid Melden CVD (Coordinated Vulnerability Disclosure) Coordinated Vulnerability Disclosure (CVD) process for reporting security weaknesses in AP ICT systems.

Quantifiable outcome

• Enforcement action on data access rights across 1185 organizations in Europe
• +1 more outcomes

Named customers2 records

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

Feature2 records

Partnerships

Six partnerships are on record, tiered core and major.

• European Data Protection Board (EDPB)coreStrategic or Co-development Partner · 1 January 2023The AP participates in the EDPB, coordinating with privacy supervisors across all EEA countries. The EDPB publishes guidelines on GDPR interpretation and coordinates enforcement actions across Europe. The AP contributes to guidelines on topics like scraping, anonymization, and blockchain.
• Samenwerkingsplatform Digitale Toezichthouders (SDT)coreStrategic or Co-development PartnerThe AP facilitates the AI & Algoritmekamer (AAK), a governmental consultation within the SDT platform for coordinating digital supervision activities among various regulators.
• Rijksinspectie Digitale Infrastructuur (RDI)coreStrategic or Co-development PartnerThe DCA coordinates with the RDI for preparing supervision on the AI-verordening, including advice to relevant ministries on setting up Dutch AI oversight.
• Global Privacy Enforcement Network (GPEN)majorStrategic or Co-development PartnerThe AP participated in the GPEN 2025 international sweep examining privacy protection for children on apps and websites, coordinated by privacy supervisors from Canada, Great Britain, and Guernsey.
• European Supervisors (AI Working Group)majorStrategic or Co-development PartnerA working group of supervisors on AI works together to share knowledge about algorithm risks. The DCA also facilitates collaboration on new AI-related questions, including challenges and risks associated with generative AI.
• Civil Rights Organizations, Companies, and CitizensmajorOthersThe AP shares its analysis of algorithm and AI risks with civil rights organizations, companies, policymakers, and individual citizens to help them make better choices to limit algorithm risks.

Scale indicators6 records

Direct peers

• Data Protection Commission (Ireland): Ireland's DPA, notable as the lead supervisory authority under GDPR's one-stop-shop for many major US tech firms; same statutory mandate, comparable enforcement culture, and EDPB role to the AP.
• Information Commissioner's Office (ICO): The UK's independent data protection regulator and freedom of information body, operating under the UK GDPR with the same mandate to receive complaints, conduct investigations, impose fines, and issue guidance as the AP.
• Garante per la protezione dei dati personali: Italy's independent data protection authority enforcing GDPR and the Italian Privacy Code with statutory powers including fines, investigations, and guidance; EDPB peer with similar regulatory structure and supervisory tradition.
• Österreichische Datenschutzbehörde: Austrian Data Protection Authority enforcing GDPR with EDPB membership, providing a like-for-like comparison for the AP's regulatory scope at a slightly smaller operational scale.
• Agencia Española de Protección de Datos (AEPD): Spain's national DPA enforcing GDPR and the LOPDGDD organic law; operates the same model of complaint handling, fines, sector-specific guidance, and EDPB coordination as the AP.
• CNIL: Commission Nationale de l'Informatique et des Libertés is France's independent data protection authority enforcing GDPR (RGPD) with statutory powers to investigate, fine, and publish guidance — the closest peer in mandate, regulatory tradition, and EDPB leadership role.
• Comissão Nacional de Proteção de Dados (CNPD): Portugal's national DPA with identical statutory mandate under GDPR, including complaint handling, fines, and EDPB coordination; closely comparable in regulatory tradition and operational scale.
• Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI): Germany's federal data protection commissioner with identical GDPR enforcement mandate, conducting investigations and issuing fines against German data controllers; comparable in supervisory tradition and EDPB role to the AP.
• Hellenic Data Protection Authority (HDPA): Greece's independent DPA enforcing GDPR with comparable complaint, fine, and guidance functions; EDPB peer with similar organizational scale and supervisory tradition.

Broad incumbents

• European Data Protection Board (EDPB): EU-level body of which the AP is a member, issuing pan-EU GDPR guidelines and coordinating cross-border enforcement actions; functions as a broader incumbent shaping the regulatory frame within which the AP operates.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/autoriteitpersoonsgegevens

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles9 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Autoriteit Persoonsgegevens (Dutch DPA)