autoriteit persoonsgegevens (dutch dpa)

What autoriteit persoonsgegevens (dutch dpa) does

Autoriteit Persoonsgegevens (AP), known in English as the Dutch DPA, is the independent statutory supervisory authority for the protection of personal data in the Netherlands, established under the General Data Protection Regulation (GDPR/AVG) and the Dutch GDPR Implementation Act (UAVG). Headquartered in The Hague and founded in its current statutory form in 2016, the AP monitors data protection compliance, processes data breach notifications, investigates privacy complaints, conducts prior consultations and data protection impact assessments, and issues fines of up to €20 million or 4% of global annual turnover for GDPR violations. It serves two primary constituencies: Dutch citizens exercising privacy rights (access, rectification, erasure) and organizations — private companies, government bodies, healthcare providers, educational institutions, and NGOs — required to comply with GDPR, with particular focus on sensitive sectors such as healthcare, childcare, finance, and technology.

The AP operates as a non-commercial regulatory body, funded entirely through Dutch government budgetary allocation rather than fees or commercial revenue. Its operational technology is limited to standard government case-management IT, a secure encrypted email system (SecuMailer), and a web archive partnership with Archiefweb. The 'products' it offers are public regulatory services rather than commercial offerings: an online data breach reporting portal (Datalek Melden), a complaint submission system (Klacht Indienen), template letters for exercising privacy rights (Voorbeeldbrieven), an AP newsletter, a bilingual privacy dictionary (Woordenboek), DPO registration information, a 5-step GDPR compliance plan for entrepreneurs, and strategic planning documents. For the 2026-2028 cycle, the AP has formally prioritized three areas: Mass Surveillance, AI oversight, and Digital Resilience — signaling an expanded enforcement focus on algorithmic systems, ransomware and cybersecurity threats, and structural surveillance risks. The AP also participates in the European Data Protection Board (EDPB) and the GDPR one-stop-shop mechanism, coordinating cross-border enforcement with EEA supervisory authorities.

Name

autoriteit persoonsgegevens (dutch dpa)

Legal name

Autoriteit Persoonsgegevens

Website

https://autoriteitpersoonsgegevens.nl

Company type

Public

Founded year

2016

Operating status

Operating

Short description

The Autoriteit Persoonsgegevens (Dutch DPA) is the independent Dutch government supervisory authority that monitors GDPR compliance, processes data breach reports, investigates privacy complaints, and issues fines, serving Dutch citizens and all organizations processing personal data in the Netherlands.

Ownership category

akta.pro rank

Headquarters

HQ city

The Hague

HQ country

Netherlands

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Infrastructure, Technology or R&D, Others

Revenue model

1. Government Funding: The Autoriteit Persoonsgegevens operates as a Dutch government authority funded through public taxation and government budgets. As a regulatory body, it does not generate commercial revenue.

Go-to-market motion1 record

Distribution channels3 records

Marketing channels4 records

Core offering

The Autoriteit Persoonsgegevens (AP) is the Dutch independent supervisory authority for the protection of personal data. It monitors and enforces GDPR/AVG compliance, processes data breach notifications, investigates privacy complaints, conducts prior consultations and data protection impact assessments, issues fines for non-compliance, and provides authoritative guidance and educational resources to both citizens and organizations operating in the Netherlands.

Product overview

The Autoriteit Persoonsgegevens (AP) is the Dutch Data Protection Authority - a government regulatory body serving as the independent supervisory authority for organizations processing personal data in the Netherlands. The AP does not offer commercial software products; instead, it provides regulatory services including data breach reporting portals (Datalek Melden), complaint submission systems (Klacht Indienen), educational resources such as template letters (Voorbeeldbrieven) and a privacy terminology dictionary (Woordenboek), secure email communication via SecuMailer, and compliance guidance including the 5-step GDPR plan (5-Stappenplan AVG). The organization also maintains a web archive and publishes strategic planning documents. Key strategic priorities for 2026-2028 focus on mass surveillance, AI oversight, and digital resilience.

Differentiator

Problem solved

Functional benefit

Products and services

• Datalek Melden (Report Data Breach)
• Klacht Indienen (File a Complaint)
• Voorbeeldbrieven (Template Letters)
• Woordenboek (Privacy Dictionary)
• FG-informatie (DPO Information Portal)
• 5-Stappenplan AVG (5-Step GDPR Plan)
• Beveiligd Mailen (Secure Email via SecuMailer)
• Webarchief (AP Web Archive)

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Three partnerships are on record, tiered core and minor.

• European Data Protection Board (EDPB)coreStrategic or Co-development PartnerThe AP collaborates with the EDPB, an independent body where all national data protection agencies from the EEA work together. Aleid Wolfsen served as Deputy Chair of the EDPB from 2019-2024. The EDPB coordinates cross-border investigations and issues guidelines on GDPR interpretation.
• EU Supervisory AuthoritiescoreStrategic or Co-development PartnerThe AP cooperates with privacy supervisory authorities in all EEA countries for cross-border data processing investigations and enforcement actions under the one-stop-shop mechanism.
• Centraal Justitieel Incassobureau (CJIB)minorOthersThe AP works with CJIB for collection of administrative fines imposed for GDPR violations.

Scale indicators1 record

Recent moves6 records

Expansion highlights5 records

Direct peers

• Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI): Germany's federal data protection commissioner, responsible for federal-level oversight and coordination with state DPAs. Directly comparable national supervisory authority with GDPR enforcement powers and EDPB participation.
• Commission Nationale de l'Informatique et des Libertés (CNIL): France's data protection authority, one of the most active EU DPAs with enforcement, guidance, and breach notification functions. Directly comparable regulatory mandate under GDPR and equivalent national legislation, with similar international cooperation through the EDPB.
• Information Commissioner's Office (ICO): The UK's independent data protection authority with comparable enforcement powers under the UK GDPR and DPA 2018. Directly comparable in scope, mandate, and structure to the Dutch DPA as a national supervisory authority handling complaints, breach reporting, and cross-border cooperation.
• Agencia Española de Protección de Datos (AEPD): Spain's data protection agency with GDPR enforcement authority. Directly comparable supervisory body performing identical regulatory functions including data breach handling, sanctioning, and EDPB coordination.
• Garante per la protezione dei dati personali: Italy's data protection authority, enforcing GDPR and national data protection law. Directly comparable regulatory function with similar mandate covering complaints, breach notifications, and cross-border investigations through the one-stop-shop mechanism.

Broad incumbents

• European Data Protection Board (EDPB): The EU-level body that coordinates all national DPAs, issues binding guidelines, and resolves disputes. The Dutch DPA is an active participant; the EDPB sits above national authorities in scope and authority, making it a broader incumbent rather than a direct peer.
• Federal Trade Commission (FTC): US agency that enforces consumer privacy through Section 5 of the FTC Act and sectoral privacy statutes. Operates as a broader incumbent covering a wider portfolio of consumer protection issues, but handles privacy enforcement comparable to GDPR supervisory authorities.

Others

• Deloitte Privacy & Data Protection practice: Major advisory firm supporting organizations with GDPR compliance, DPIAs, and privacy program implementation that interface directly with the Dutch DPA. Adjacent ecosystem participant rather than a competitor, but materially engaged with the same regulatory framework the AP enforces.

Regional players

• Office of the Privacy Commissioner of Canada: Canada's federal privacy regulator enforcing PIPEDA and the Privacy Act. Performs substantially the same supervisory and enforcement function as the Dutch DPA under comparable data protection legislation, but operates in a different jurisdiction.
• Office of the Australian Information Commissioner (OAIC): Australia's privacy and information rights regulator with comparable mandate on privacy complaints, breach notifications, and enforcement under the Privacy Act. Comparable in role but geographically separate.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks4 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/autoriteitpersoonsgegevens

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about autoriteit persoonsgegevens (dutch dpa)