On 30 October 2026 the Autoriteit Persoonsgegevens (AP) published its new Handhavingsbeleid in the Staatscourant (2026, 38702). Its most discussed feature is section 5.6, an erkennings- en berustingsprocedure, or acknowledgement and acquiescence route. In the policy's words, the company acknowledges the violation and accepts the fine, and "in ruil daarvoor verlaagt de AP de boete met maximaal 35%". The AP reduces the fine by up to 35% in exchange.
The strongest case for the AP's approach
The case for the AP is simple. Contested GDPR fines can take years to resolve. The AP's biggest recent decision, the EUR 824.99 million fine on Uber reported on 24 August 2026, is already being appealed. Uber is also still disputing its earlier Dutch fines of EUR 10 million (2023) and EUR 290 million (2024), according to Just Auto's report. A regulator with finite staff has a legitimate interest in closing cases quickly. Complaints to the AP rose 75% in 2025 to more than 13,500, while it opened only 29 deeper investigations, according to DutchNews. Settlement is a normal tool in competition and tax enforcement, and it frees capacity for the cases that need it.
What the company actually gives up
The price is steep. According to Stibbe's analysis, the company must:
- admit the violation;
- waive objection and appeal;
- consent to publication of the decision with a press release, which it may check for factual errors only.
The route is available only once, and the policy states that the procedure "is eenmalig en wordt niet opnieuw opgestart" (it is one-time and is not restarted). A settled case still counts as a prior violation, so it can raise the starting point for any later fine. There is no right to the route. The AP uses it only where efficiency gains are expected, and it is less likely once decision-making is already advanced.
The admission matters beyond the AP. Stibbe notes that publicity and an admitted breach could feed collective damages claims. A company weighing 35% off the fine must also weigh what the admission does to civil exposure.
Publication by default changes the arithmetic
The settlement policy follows the AP's 1 September 2026 switch to publishing enforcement decisions by default. Stibbe's authors argue this makes consenting to publication "cost less than it seems", because publicity is now the baseline. That is true for reputation. What the company really surrenders is the ability to challenge the fine, along with any argument that the violation was narrower than the AP found.
This is the part we think deserves scrutiny. A settlement discount only improves enforcement if the underlying findings are sound. If the AP's reading of a provision is aggressive, an appeal is how a court corrects it. Under this route that correction never happens. The legal interpretation hardens into published precedent that no tribunal has tested. Smaller firms facing a large exposure will be the likeliest to accept. They are also the least able to afford the litigation that would produce clear case law.
The DPO provision is the policy's best idea
The policy gives registered data protection officers a formal role. Per Stibbe, a DPO registered with the AP receives the investigation report, the notice of intended enforcement, progress updates, the hearing report and the final decision. The DPO may attend the hearing as an observer. Where a DPO exists, any remediation proposal must include the DPO's advice, and the DPO's involvement is a factor in choosing the enforcement instrument. The AP will not treat the DPO as the company's representative.
This is a sensible, proportionate incentive. It rewards organisations that built internal privacy governance by giving that function a seat in the process, instead of punishing every breach identically. It also sits comfortably with the EDPB's Guidelines 04/2022 on calculating administrative fines, which are meant to make fine-setting more consistent across Member States.
Where proportionality should push back
Three safeguards would make the route more defensible.
- Publish the discount. Each settled decision should state the starting fine, the reduction applied and the reasons. Without that, nobody can tell whether 35% is routine or exceptional.
- Keep legal reasoning reviewable. Settled decisions should be labelled as unappealed, so that regulators, courts and other companies do not treat them as tested authority.
- Report outcomes. The AP should say annually how often the route was offered, accepted and declined. A discount that is quietly steered toward easy cases would add little to deterrence.
The broader risk is cultural. GDPR enforcement should be about getting data handled lawfully, not about collecting admissions. A faster, cheaper path to compliance is welcome, but only if companies keep the practical ability to say no. The 35% figure is a ceiling, the route is discretionary, and it can be used only once. Those limits make this a modest tool, and the AP deserves credit for consulting on it and dropping an earlier requirement that companies commit to compensating affected individuals.
The test will come in the first published settlements. If they show clear findings, transparent reductions and genuine remediation, this route could become a model for other Member State authorities. If they show opaque discounts and unreviewed legal theories, they will confirm the critics' view that speed was bought at the expense of the rule of law.