Submitting a tip-off or a complaint to the Dutch DPA

You want to submit a tip-off or a complaint to the Dutch Data Protection Authority (Dutch DPA). This means that you have experienced something or that you suspect that a person or an organisation does not comply with the privacy law. It’s good that you want to do something about it. The Dutch DPA can help you with this in 3 steps.

We distinguish between a tip-off, a data breach tip-off and a complaint. We ask you read the information below with due care.

On this page

View the video on submitting a tip-off or a complaint (in Dutch)

Step 1: Do you have a tip-off or a complaint?

It is important that you choose the right option when you fill in the form, to ensure that your complaint or tip-off ends up with the right department and we can help you better.

Below you can read what the difference is between a complaint and a (data breach) tip-off and which option is your best choice in your case. Sometimes, submitting a tip-off or complaint to the Dutch DPA is not the best option, and a different solution is possible. Do you doubt whether you have to submit a complaint or tip-off? In that case, contact us.

Tip-off

  • In the case of a tip-off, you suspect that an organisation does not comply with the privacy law.
  • A tip-off may be about your own personal data, but also about someone else's.
  • When submitting a tip-off, you do not have to leave your contact details. You are allowed to do this, though.
  • The Dutch DPA assesses every tip-off received. Tip-offs help the Dutch DPA do its job. Submitting a tip-off is always useful. You do not receive any personal message about what we do with your tip-off.

Filling in the form takes about 10 minutes.

Data breach tip-off

  • Do you have information about a data breach? Have you, for example, seen that there is a data breach at an organisation? Do you doubt whether that data breach has been handled correctly? Or do you suspect that your data have leaked? Then you can report this to the Dutch DPA with a data breach tip-off. 
  • The Dutch DPA will then assess whether it concerns a data breach which should have been reported to the Dutch DPA by the organisation that has (experienced) the data breach. Reporting is not necessary for every data breach. If reporting is necessary, the Dutch DPA will check whether the organisation has already reported the data breach. If this is not the case, the Dutch DPA may contact the organisation. Your tip-off may also be a reason for the Dutch DPA to initiate an investigation.
  • It is important that you pass on the possible data breach to the organisation itself first. An organisation can only do something about a data breach if it knows that there is one.

Filling in the form takes about 10 minutes.

Also read further action to be taken by you if you have become the victim of a data breach.

Have your data been passed on to another organisation without your consent? Then this is not a data breach, but another possible infringement of the GDPR. Do not submit a data breach tip-off in that case, but a tip-off or complaint. 

Note: has a data breach arisen at your own organisation, and do you want to report this to the Dutch DPA as a controller? Then view the information about the data breach notification obligation.

Complaint

  • A complaint is about your own personal data, or those of your child. A complaint may also pertain to the personal data of someone for whom you have a power of attorney.
  • When submitting a complaint, you fill in your data. The Dutch DPA will share your complaint with the organisation to which your complaint pertains, and also shares your identity in the process. After all, it is about your personal situation. Do you not want this to happen? Then submitting a tip-off is the better option.
  • Do you submit a complaint? Then we will ask for proof, such as emails of other correspondence with the organisation. Such as the response of the organisation and/or the DPO. Do you add insufficient proof? Then we will ask you to do this at a later time. You can read in step 2 about the conditions that your proof also has to meet. 
  • We expect that you have contacted the organisation for a solution first. For example through the Data Protection Officer (DPO), if the organisation has one. You indicate your complaint and the exact problem clearly. You can use an example letter (in Dutch) of the Dutch DPA for this purpose. Give the organisation 4 weeks to respond to your complaint.
  • You will receive a personal message after we have assessed your complaint. In this message, we tell you what we will do or have done with your complaint.

Filling in the form takes about 15 minutes.

Tip: look for the privacy statement of the organisation on the website. And read what your privacy rights are. This will help you put your complaint into the right words.

Step 2: Preparing your notification

By preparing your notification, you can fill in the form more quickly. Therefore we recommend that you already have the following at hand:

  • Evidence to support your tip-off or complaint, such as screenshots. The evidence should make clear what exactly your tip-off or complaint is about and what the problem is. You can read more about this in step 1.
  • A copy of your contact with the organisation or the person to whom your complaint pertains. This shows that you first have sought contact with the organisation or person to solve the problem. For example by email or letter. You can read more about this in step 1.
  • When you submit a complaint on behalf of someone else: a power of attorney. You can use this example (in Dutch) for that purpose. 

Note: Do not add information that is not relevant to your notification or that you do not want to share. You can make that information illegible. All information that you provide may be used by the Dutch DPA for conducting an investigation and legal proceedings. The Dutch DPA shares a copy of your complaint and our decision on your complaint with the organisation or the person to whom your complaint pertains. Under the Dutch General Administrative Law Act (Awb), we are obliged to do this. 

Step 3: Filling in the form

You can use the form to submit your tip-off, data breach tip-off or complaint step by step. You will find additional explanations to many questions under the ? sign.

We recommend that you fill in the form on a computer or laptop. This is easier on a big screen than on a smartphone or tablet.

Adjusting or withdrawing your complaint or tip-off

Maybe you want to adjust your earlier complaint or tip-off. For example because you have additional evidence now. Or you want to withdraw your earlier complaint or tip-off, because the situation has been resolved. You can do this in the form as well.

Privacy statement

When you submit a complaint or tip-off, we process your personal data. You can read in our privacy statement (in Dutch) how and why we do this.

Notification form

To the notification form (in Dutch) 

After your notification: This is what the Dutch DPA does with your tip-off or complaint

Tip-offs, data breach tip-offs and complaints are valuable for the Dutch DPA. They help us protect the personal data of people living in the Netherlands even better. That is why we look at every tip-off and complaint that we receive. Even if we do not investigate it any further, we can use your tip-off or complaint for our work. You can read more about this on the page Handling of complaints by the Dutch DPA

Did you submit a complaint about an international organisation? Then the Dutch DPA may handle your complaint in collaboration with other European supervisory authorities. As a result, handling the complaint may take longer.

Quick answers

Who can submit a tip-off or complaint?

Everyone can make a report. Do you want to submit a complaint? Then you can also authorise someone else to do this for you.

Giving a tip-off

Do you not want to leave your personal data when making a report? Or is your privacy complaint not about a processing of your own personal data? Then you can only submit a tip-off.

Submitting a complaint

Do you report a privacy complaint about a processing of your own personal data? Then you can submit this complaint yourself.

But you can also authorise someone else to submit the complaint on your behalf. Such as a lawyer or a Legal Aid and Advice Centre. An interest organisation can also submit a complaint on your behalf.

Is submitting a complaint to the Dutch DPA the best option for me?

There are a few situations in which submitting a complaint with the Dutch DPA is not your only option. Sometimes, an alternative option offers you a better chance of a solution.

  • Does your complaint relate to a decision by the government? Such as a municipality or the Employee Insurance Agency UWV? Then you can object to the decision or bring an appeal to the administrative court.
  • Are legal proceedings pending about your complaint? Then that other body will review your complaint.
  • Do you suspect an abuse at your work that puts the protection of privacy and personal data into danger? It may be possible for you to make a report to the Dutch DPA as a whistle-blower.
  • Is your complaint about a camera issue with neighbours? In that case, it is best to take action yourself.
  • Do you have a complaint about your privacy rights, such as the right of access to data or the right to have data removed? Read here what you can do.

Read more about how the Dutch DPA deals with your complaint.

Can I submit a complaint anonymously?

No. If you submit a privacy complaint, we ask you for your personal details. Because the Dutch DPA investigates a privacy violation in your personal situation, the Dutch DPA will disclose your identity to the organisation or person that your complaint relates to. In the case of a complaint, the Dutch DPA will also keep you informed of its progress.

Do you not want to share your data? Then you can submit a tip-off.

Can I submit a privacy complaint by letter?

Yes, you can. State the following in your letter:

  • which personal data your complaint relates to;
  • which organisation it concerns;
  • whether you have already submitted a complaint to the organisation to which your privacy complaint relates;
  • how the organisation responded to your complaint;
  • whether (the negative effect of) the processing of your data still continues;
  • what you want to achieve with your privacy complaint;
  • your name, address and telephone number.

Note: do you want to submit a handwritten privacy complaint? Make sure that it is clearly legible.

Send your letter to:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag.

You can submit a privacy complaint in Dutch or in English.

Contact with the Dutch DPA

Do you have difficulty reading or writing? Contact our employees.

When will I receive a message about my tip-off or complaint?

Do you submit a tip-off? In that case, you will not receive a response from us. But we review every tip-off.

Do you submit a complaint? Then we will inform you about the progress, in any case 3 months after you submitted your complaint. Are we unable to report a result within 3 months? Then you will receive a letter from us again, no later than 6 months after this message. In this letter, we will inform you about the result or the progress of the handling of your complaint.

Also see: How the Dutch DPA deals with complaints

How do I initiate application proceedings with the court?

You initiate application proceedings by writing a letter to the civil-law sector of the district court. You do not need a lawyer to do this.

Conflict about privacy rights

You have privacy rights. Such as the right to access your data, to have your data rectified or removed. You can, for example, ask an organisation to give you access to your data.

The organisation has to reply to your request within 1 month. Does the organisation fail to do this? Or do you receive a response, but are you not satisfied with it? Then you can initiate application proceedings.

Note: this only applies if it concerns a business. Does it concern a government organisation? And does this organisation not respond? Then you can give the organisation notice of default for failure to decide in time. Do you receive a response, but are you not satisfied? Then you can object.

Normally, you need a lawyer for submitting your application to the civil court. But this does not apply if the case concerns your privacy rights. This is an exception that can be found in Article 35, paragraph 4 of the GDPR Implementation Act.

Contents of the application

It is important that you explain the situation in your letter. And that you indicate exactly what you want the court to do. You can ask the court, for example, to order a website administrator to remove your data from a certain website. Or you can ask for access to your file at an organisation.

You can also ask the court, for example, for adjustment of incorrect personal data, restriction of the use of your data, or transfer of your data to another organisation.

Support your story by adding copies of evidence and other important documents to your letter.

Address of the court

On rechtspraak.nl you can find the address of the court in your district where you can send your letter.

Period for application

You have to send your letter within 6 weeks after you received the organisation's answer to your request. Did the organisation not respond in time? Then you do not have to submit your application before a specific date.

Summons

Do you want the court to forbid the use of your personal data by an organisation? Or have you suffered damage because an organisation does not use your personal data in accordance with the law? Then you can initiate summons proceedings against that organisation.

How do I initiate summons proceedings with the court?

Do you want the court to forbid the use of your personal data by an organisation? Or have you suffered damage because an organisation does not use your personal data in accordance with the law? Then you can initiate summons proceedings against that organisation. You need a bailiff to do this.

Summons

A summons is a letter to the organisation in which you summon the organisation to appear before the court. A bailiff issues the summons to the organisation and sends the summons to the court.

On rechtspraak.nl you can find more information about the: