The Dutch Data Protection Authority (AP) has launched a public consultation on a draft list of data processing operations exempt from the obligation to carry out a data protection impact assessment (DPIA).

This draft aims to reduce the regulatory burden for small and medium-sized enterprises (SMEs) and self-employed entrepreneurs in the Netherlands. Stakeholders, including SMEs, experts, and self-employed workers, are invited to submit their comments by 10 August 2026 to ensure the list's suitability for practice. After this consultation, the list will be refined and then submitted for the opinion of the European Data Protection Board (EDPB). The final version will then be published in the Dutch Official Journal, from which date it will become valid. An anonymized summary of the responses will also be published.