How the Dutch DPA deals with complaints

The Dutch Data Protection Authority (Dutch DPA) is the Dutch supervisory authority for the processing of personal data. One of our tasks is handling complaints of people who suspect that an organisation or a person does not comply with the privacy rules. This may concern businesses, the government (including police and the judiciary) and other organisations.

Do you have any suspicions that your personal data are not processed correctly by an organisation? Meaning: in a manner that conflicts with the European privacy rules? Then you have the right to lodge a complaint to the Dutch DPA.

On this page you can read how we handle your complaint.

We determine the best approach for your complaint

Do you have a suspicion that the privacy law has been infringed? Let us know. We will always review your complaint, because your complaint will give us knowledge and will help us protect the processing of personal data in the Netherlands even better. We are there for you and can think along with you to find a solution to your problem. When we receive your complaint, we will therefore decide what the best approach is to solve your problem as effectively and as quickly as possible. The best approach varies from complaint to complaint, and we will inform you how we are going to deal with your complaint.

Organisations have to process personal data in a proper manner. They have to comply with the GDPR and other sector-specific legislation. The Dutch DPA supervises compliance with the GDPR. We do this informally, but also formally, by imposing sanctions. The Dutch DPA may, for example:

• contact the organisation or person to whom your complaint pertains by telephone to mediate;
• send a warning letter to the organisation to which your complaint pertains;
• have what we call an instructive conversation on compliance with standards with the organisation to which your complaint pertains, to ask for more information or to explain what the rules are;
• if there is a suspicion of a serious offence: start a comprehensive investigation into the organisation to which your complaint pertains, and possibly pay the organisation a visit;
• impose an administrative sanction, for example a fine, if our investigation shows that the organisation violates the privacy rules.

Often there are also things that you can do yourself to solve the problem. If desired, the Dutch DPA can advise you on this. The advice may also be that the Dutch DPA is not authorised to act or that there are better options for solving the complaint. You can read more about this below on this page.

Your complaint is always valuable
Even if we decide that we will not conduct any further investigation into your complaint, your complaint will help us to protect the processing of personal data in the Netherlands. All notifications that we receive help us understand to what extent which people feel that organisations comply with the privacy laws.

If we do not conduct any further investigation into your specific complaint, this complaint may be helpful for another investigation that we are conducting. The information also helps us determine research and policy topics and improve our website. Submitting a complaint is therefore always useful.

This is how we deal with your complaint

Below you can read what happens to your complaint once we have received it.

The first assessment of your complaint

First of all, you have to take action yourself: you contact the organisation or the person to whom your complaint pertains. Often, you will be able to reach a solution together, without the help from the Dutch DPA being required. If you decide to lodge a complaint, we will ask you to include your information about the contact with the person or organisation, as well as any other relevant evidence you may have collected, along with your complaint.

After receipt of your complaint, we will check if you have sent sufficient evidence. We need this evidence to be able to handle your complaint in the best possible manner. 

Does your complaint not meet these requirements? Then keep in mind that the Dutch DPA will not be able to investigate your complaint any further.

You can read more about preparing and sending your complaint on the page Submitting a tip-off or a complaint to the Dutch DPA.

After this, there are 3 possibilities:

1. Your complaint and evidence show that the person or the organisation infringes the privacy law. The Dutch DPA takes appropriate action against the infringement, and we let you know how we will do this.
2. We see insufficient grounds for an infringement of the privacy law in your complaint. We will not investigate your complaint any further in that case. You will receive a message about this. In it, we will also tell you the reasons for our decision.
3. All other cases. We will then determine if we will investigate your complaint further. Below you can read how we determine this. If we decide to investigate your complaint further, we will contact the organisation to which your complaint pertains and present your complaint to them. We may also ask you for more information. You will hear from us then.

If we see that your complaint falls under possibility 3 and an infringement is therefore not immediately clear, we will decide whether we will investigate your complaint further. We do this in the following manner.

Is further investigation necessary?

The Dutch DPA has to make choices. This enables us to be efficient and effective and help people in the best possible manner. That is why we use these criteria to decide whether your complaint is eligible for further investigation by the Dutch DPA:

• Your complaint concerns an infringement that is still continuing.

We feel it is important to take action against infringements that are still continuing. The best option is when organisations and persons solve problems in joint consultation. So has the organisation or the person to whom your complaint relates ended the suspected infringement themselves? And did this happen without intervention by the Dutch DPA? Then the Dutch DPA will usually not take any further action. We may send a letter to the organisation to explain what the rules are. We may also let them know that we will conduct an investigation if this proves to be necessary at a later time.

• We see a wider social interest.

When we conduct a further investigation, we feel it is important that this has a wider social significance. This means that your problem is a signal that there is a wider privacy issue in society. And that, for example, a lot more people have the same problem. In addition, we check whether your complaint falls under the focus areas of the Dutch DPA. Do we not conduct a further investigation? Then we can send a letter to the organisation instead, enter into talks with a sector association, or give you tips for solving your problem as quickly and effectively as possible yourself.

• No other proceedings are pending about your complaint.

Are or were proceedings about this specific subject already pending with another authority, such as the court? If  so, that authority is already assessing your problem and will provide you with the desired clarity.

• Your complaint specifically relates to a GDPR issue.

Is your complaint part of a bigger problem that actually belongs with a court or another body such as a disputes committee? Such as a rent issue that you should submit to the rent tribunal or the subdistrict court, while a GDPR issue also plays an indirect role? Then it is not efficient and effective if the Dutch DPA conducts a further investigation into the GDPR issue, while the bigger issue continues to exist. In such a case, we will send a letter to the organisation or person to whom your complaint pertains. We explain the rules in this letter. We also explain in this letter that we may still decide to conduct a further investigation if we receive more complaints.

• The Dutch DPA has not investigated the subject of your complaint earlier.

If the Dutch DPA has investigated a specific subject at an earlier time, we feel that it is not efficient and effective to investigate the same issue again unless the situation has changed.

• Another reason. 

Though the Dutch DPA would like to investigate every complaint further, we may also have other reasons to decide that we are unable to take sufficiently efficient and effective action with regard to your complaint. In that case we will let you know why, and what action could possibly be taken by you.

Other solution for your problem

In some cases, we opt for a solution other than further investigating your complaint. Experience has taught us that an investigation is not always the best option. For example, in the case of camera use by neighbours.

Example: camera use by neighbours
Suppose that you have lodged a complaint because your neighbours have installed cameras that point at your home or the public road. In that case, we can help you by sending a letter to the organisation or person that uses the cameras. In this letter, we explain what rules apply for camera surveillance. Does the organisation or person actually not comply with these rules? Then that party will have to adjust the use of the cameras. In practice, it turns out that many organisations or persons do this when they receive a letter from the Dutch DPA.

Is your problem still not solved after this, and can't you work it out with your neighbours (possibly with the help of community mediation or another type of mediation)? Then you can also ask a court for an opinion. You can read on the website of De Rechtspraak, the Dutch judicial system, what you have to do to initiate proceedings in case you have a conflict or another problem with your neighbours.

The Dutch DPA therefore looks for the best solution for every situation and determines whether it is the right party to help you. The Dutch DPA may, for example, refer you to on to community mediation, the Legal Aid and Advice Centre, or another body.

Also view: Is lodging a complaint with the Dutch DPA the best option for me? (at the bottom of the page)

Always feedback from the Dutch DPA

The Dutch DPA will always inform you after 3 months about the result or the progress of the handling of your complaint. As soon as the Dutch DPA has handled your complaint, you will also receive feedback on this.

Do you have any questions?

Do you doubt whether you can lodge a complaint with the Dutch DPA? Or do you have any questions about what we can do for you and can't you find the answer on our website or at the FAQs? Then contact our Privacy Information and Reporting Centre by telephone. We will be happy to help you.

Lodging a complaint digitally

You can lodge your complaint digitally.

Complaints reports

View the complaints reports of the Dutch DPA.