From 1 September 2026, the Autoriteit Persoonsgegevens (AP) no longer decides case by case whether to name the organisations it sanctions. Under the Verzamelwet gegevensbescherming, an omnibus act of 10 June 2026 published as Staatsblad 2026, 154, publication of administrative sanctions is now the legal default under the Dutch GDPR Implementation Act (UAVG).
What actually changed
The mechanics are narrow but consequential. The AP first tells the organisation of its intended publication decision and lets it respond. It then issues a final publication decision. Publication comes no earlier than ten working days after the organisation is notified. Information that the Wet open overheid (Woo) shields from disclosure is excluded. If the organisation asks the administrative court for a preliminary injunction (voorlopige voorziening), publication is postponed until the judge rules. The same applies to objection decisions that impose a sanction.
The obligation entered through an amendment from Tweede Kamer member Six Dijkstra, filed in the legislative dossier 36264 as a revised amendment on a duty to publish sanctions imposed by the AP. It was not part of the government's original package, which is worth remembering when judging how carefully the timing was designed.
The strongest case for the rule
Transparency has real merit. Fines are public acts of the state, and the people affected by a breach have a legitimate interest in knowing which organisations mishandled their data. Publication also teaches. When the AP fined Clearview AI €30.5 million on 3 September 2024 for building a facial-recognition database, other companies could read exactly what conduct crossed the line. A regulator that sanctions quietly gives the market less guidance and the public less ability to hold either the regulator or the offender to account. Reputation also works as a deterrent where fines are small relative to revenue.
Where the design is thinner than it looks
The ten-working-day window is the pressure point. Time to the court is not the same as time to a ruling. An organisation must file for interim relief inside roughly two working weeks, while it is also deciding whether to object to the underlying decision. Large firms with counsel on retainer will manage this. A school, a small clinic or a local business that receives a modest fine may not even have identified a lawyer by day ten. The rule therefore risks being strongest in effect against those least able to use its safeguards.
The second concern is finality. The AP's largest recent case shows why. In August 2026 the AP fined Uber €824.99 million for violating the GDPR's ban on solely automated decision-making by deactivating driver accounts without human review, and for failing to inform drivers adequately. Uber has appealed and calls the fine disproportionate. This sits on top of earlier Uber decisions of €10 million (2023) and €290 million (2024), the latter for transfers of driver data to the United States. The AP's own page records that Uber is contesting these. A sanction under appeal is an allegation the state has made, not a settled finding. Naming organisations before an independent court has looked at the case can inflict reputational damage that no later reversal repairs.
The pro-innovation concern is not that companies should avoid scrutiny. It is that unpredictable, permanent reputational penalties raise the cost of operating in a jurisdiction, and that cost is borne disproportionately by startups, which cannot absorb a bad news cycle the way a multinational can.
The scale of the enforcement system
The AP is not short of work. Law firm CMS reports that the authority received more than 13,500 complaints and tips in 2025, mostly about access and erasure rights, followed by unlawful processing, data breaches, cameras, and tracking tools such as cookies. Only a small fraction can end in a fine. Default publication therefore applies to a thin slice of cases, which makes the quality of each one matter more. Each published sanction becomes, in practice, the authority's best statement of what the law means.
A proportionate way to run it
The rule need not be repealed to be improved. Three adjustments would keep the transparency benefit while narrowing the risk:
- Make the notice meaningful. The AP should give every organisation a plain-language explanation of the ten-day window and the court route when it sends the publication decision, and should say so prominently for small and non-commercial recipients.
- Publish the legal status. Every entry should say whether the decision is final, under objection, or before a court, and be updated when that changes. Readers should not mistake an allegation under appeal for a settled outcome.
- Use the Woo exceptions seriously. Trade secrets, security details and personal data of victims should be redacted rather than leading to either blanket publication or blanket withholding.
The Netherlands has chosen openness, and that choice fits a rule-of-law tradition that values reasoned public decisions. Whether it also protects due process will depend less on the statute than on how the AP applies the window in the first cases. Other EU regulators, which still decide on publication case by case, will be watching the first cycle before copying it.