Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
The Dutch GDPR Implementation Act (UAVG): the Netherlands' choices within the GDPR's opening clauses. Children under 16 need a parent's consent; special category data may be processed only on the GDPR's grounds or the UAVG's narrow national ones (biometric identification only where needed for a weighty public-interest access or security need, employers' health data only for sick pay, pensions and reintegration); criminal-offence data about staff only under rules the works council has approved; the citizen service number (BSN) only where a law prescribes it; plus the Autoriteit Persoonsgegevens' powers and fines. Consolidated as amended by the Verzamelwet gegevensbescherming from 1 September 2026 (art. 23a not yet in force).
Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) is a compliance framework from Netherlands with 5 domains and 36 controls that map to 2 other frameworks. The largest domains are Special categories of personal data (arts 22 to 30b) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (14 controls), Exceptions, restrictions and special grounds (arts 40 to 47a) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (9 controls), Criminal-offence data (arts 31 to 33) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (7 controls). Every control below carries what it requires and what an assessor expects to see.
Get the official standard. This page is a source-grounded companion to the published text, not a replacement for it.
Visit wetten.overheid.nlFramework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Consent of minors and persons under guardianship (art. 5) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
| Code | Title |
|---|---|
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::5(1) | Art. 5(1) Obtain the legal representative's consent for data subjects under 16 |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::5(2) | Art. 5(2) Obtain the legal representative's consent for persons under guardianship, administration or mentorship |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::5(3) | Art. 5(3) Accept withdrawal of consent from the representative and from a data subject of twelve or over |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::5(4) | Art. 5(4) Let the right person exercise data subject rights for minors and wards |
Criminal-offence data (arts 31 to 33) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
| Code | Title |
|---|---|
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::31 | Art. 31 Process criminal-offence data only where arts 32 or 33 allow it |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::32 | Art. 32 Rely on the general grounds for criminal-offence data only in their cases |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::33(1) | Art. 33(1) Rely on the public-sector grounds for criminal-offence data only in their cases |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::33(2) | Art. 33(2) Process criminal-offence data for own purposes only to decide on a request or to protect against offences |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::33(3) | Art. 33(3) Process criminal-offence data about staff only under rules adopted through the works council procedure |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::33(4) | Art. 33(4) Process criminal-offence data for third parties only as a licensed agency, within a group or with an AP permit |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::33(5) | Art. 33(5) Process criminal-offence data for statutory audits only as necessary for the engagement |
Data subject requests and the data protection officer (arts 34, 39) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
| Code | Title |
|---|---|
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::34 | Art. 34 Decide on data subject requests in writing within the GDPR periods |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::39 | Art. 39 Keep the data protection officer bound to secrecy on complaints and requests |
Exceptions, restrictions and special grounds (arts 40 to 47a) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
| Code | Title |
|---|---|
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::40 | Art. 40 Apply automated decisions under the statutory exception only with human intervention, a hearing and a challenge route |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::41 | Art. 41 Restrict data subject rights only where necessary and proportionate for a listed interest, weighing the listed factors |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::42 | Art. 42 Rely on the exemption from notifying data subjects of breaches only as a financial undertaking |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::43 | Art. 43 Apply the journalistic and expression exemptions only to processing exclusively for those purposes |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::44 | Art. 44 Set aside access, rectification and restriction for research or statistics only with purpose-limitation safeguards |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::45 | Art. 45 Give access to archives and let data subjects add their own account |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::46 | Art. 46 Use the citizen service number (BSN) or any statutory ID number only to execute the law that prescribes it |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::47 | Art. 47 Apply the public register exceptions only where the register's own law provides a correction procedure |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::47a | Art. 47a Set up temporary committees' processing in the instituting decision, and report before dissolution |
Special categories of personal data (arts 22 to 30b) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)
| Code | Title |
|---|---|
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::22 | Art. 22 Process special categories only under an exception of the GDPR or the UAVG |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::23 | Art. 23 Rely on the national general exceptions for special categories only in their cases |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::24 | Art. 24 Meet all four conditions before processing special categories for research or statistics |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::25 | Art. 25 Process data revealing racial or ethnic origin only for identification or preferential-treatment policies, within limits |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::26 | Art. 26 Process data revealing political opinions only for requirements of public-body functions |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::27 | Art. 27 Process religious or philosophical data for spiritual care only absent written objection, and do not disclose it |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::28 | Art. 28 Process genetic data only about the person it was obtained from, or on the strict research or medical grounds |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::29 | Art. 29 Use biometric identification (fingerprint or face) only where necessary for authentication or security for a weighty public-interest access need |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30(1) | Art. 30(1) Process employee health data only as necessary for statutory, pension or collective-agreement entitlements or for reintegration |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30(2) | Art. 30(2) Process health data in schools, probation, child protection and custody only as necessary for their tasks |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30(3) | Art. 30(3) Process health data in care and insurance only as necessary for treatment, management, risk assessment or policy administration |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30(4) | Art. 30(4) Ensure health data are processed only by persons bound to confidentiality |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30a | Art. 30a Inform patients when care providers transfer medical records for retention, and do so free of charge |
| netherlands-gdpr-implementation-act-uavg-uitvoeringswet-avg-2018::30b | Art. 30b Transfer medical records held by non-care providers only to a care provider that will keep them |
Maps to 2 other frameworks
Coverage is not the same as your position
This page shows what Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) and who does it apply to?
Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) is a compliance framework from Netherlands with 5 domains and 36 controls. The Dutch GDPR Implementation Act (UAVG): the Netherlands' choices within the GDPR's opening clauses. Children under 16 need a parent's consent; special category data may be processed only on the GDPR's grounds or the UAVG's narrow national ones (biometric identification only where needed for a weighty public-interest access or security need, employers' health data only for sick pay, pensions and reintegration); criminal-offence data about staff only under rules the works council has approved; the citizen service number (BSN) only where a law prescribes it; plus the Autoriteit Persoonsgegevens' powers and fines. Consolidated as amended by the Verzamelwet gegevensbescherming from 1 September 2026 (art. 23a not yet in force). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) actually require?
Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) has 36 controls organised across 5 domains. The largest domains are Special categories of personal data (arts 22 to 30b) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (14 controls), Exceptions, restrictions and special grounds (arts 40 to 47a) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (9 controls), Criminal-offence data (arts 31 to 33) – Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) do I already cover?
Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) maps to 2 other compliance frameworks. The top mapping partners are GDPR (68% coverage), ISO 27001:2022 (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018)?
Start your Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Netherlands GDPR Implementation Act (UAVG - Uitvoeringswet AVG, 2018) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 36 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required