The Dutch Data Protection Authority (AP) will make the publication of sanctions related to the GDPR mandatory from 1 September 2026, following a legislative amendment.

This new legal obligation, resulting from an amendment to the Implementation Act of the General Data Protection Regulation, replaces the authority's previous practice based on its own publication policy. The measure aims to strengthen legal certainty and clarify the enforcement standards of the GDPR for all organizations. The administrative sanctions concerned include fines, injunctions with periodic penalty payments, and processing prohibitions. Before any publication, the sanctioned organization is informed and has the opportunity to respond. Publication does not occur before a period of 10 working days following the notification of the decision to publish, unless the organization has already communicated about the sanction or does not oppose it. Organizations can challenge the sanction and its publication, including by legal action to suspend its dissemination.

At the same time, the AP will adapt its publication policy to align the treatment of sanctions taken under the Police Data Act (Wpg) and the Judicial and Criminal Data Act (Wjsg) with that of GDPR sanctions. This decision aims to extend transparency to all its supervisory activities. The publication policy for other types of documents remains unchanged.