Using your privacy rights

There are rules that are the same for all privacy rights. For example, within which period an organisation has to respond to your request.

Tip: make your request in writing

You can best send the organisation a written request, by letter or email. This is useful for obtaining evidence. Because if the organisation does not respond to your request, or the organisation refuses your request, you can demonstrate which steps you have taken. This is necessary if you want to submit a complaint to the Dutch Data Protection Authority (Dutch DPA) or want to go to court.

16 years or older

You can only make a request if you are 16 years or older and have not been placed under curatorship. If you do not meet these requirements, the request has to be made by your legal representative. This is usually one of your parents. In that case, the organisation will have to send the answer to that person as well..

Read more: your privacy rights.

Making a request for your child

You can make a request for your child if your child is under the age of 16, and you are the legal representative of your child. This means that you have custody of your child. Usually, one or both parents have custody.

Verifying identity

Before processing your request, the organisation has to verify your identity. This is for the protection of your privacy. To prevent someone else from gaining access to your data.

Organisation has to respond within 1 month

The organisation is obliged to respond to your request by letter or email within 1 month. Is your request complicated? Or did you send multiple requests to the same organisation? Then the organisation may take 2 more months to respond. In that case, the organisation will have to let you know the reason for this delay and that a response will take longer within 1 month.

Organisation does not respond

Did you not receive a response from the organisation within 1 month? Then you can contact the Data Protection Officer (DPO) or privacy officer of the organisation, if the organisation has one. You can find the contact details of this person in the privacy statement on the organisation's website.

Does this person not respond either? Or are you not satisfied with the response? What you can subsequently do depends on whether it concerns a business or a governmental organisation.

Business

You can submit a complaint to the Dutch DPA. Or initiate application proceedings with the court.

Governmental organisation

You can submit a complaint to the Dutch DPA. Or give the governmental organisation notice of default because of failure to decide in time. Do you not receive a decision within 2 weeks after giving notice of default? Then you can lodge an appeal because of failure to decide in time with the administrative court.

Honouring or refusing the request

In the response, the organisation has to inform you whether it will honour your request. And if so, what exactly the organisation is going to do. Does the organisation refuse your request? Then the organisation will have to let you know why.

Do you disagree with the refusal of your request? Then you can submit a complaint to the Dutch DPA. Or you can initiate application proceedings with the court, if it concerns a business. Does it concern a governmental organisation? Then you can lodge an objection with the governmental organisation.

No charges

The organisation is not allowed to ask money from you for dealing with your request, unless you send an excessive number of requests to the same organisation. In that case, the organisation is allowed to charge administrative costs. The organisation may in that case also choose to refuse your request.