Amụma nzuzo na Netherlands: ihe ọ ga-enwerịrị n'okpuru GDPR

Under arts. 12, 13 and 14 of the GDPR you must tell people who you are, why and on what legal basis you process their data, who receives it, how long you keep it and which rights they have; on a website, a privacy statement (nkwupụta nzuzo) is the practical way to do that. A statement copied from a competitor or a generator usually fails, and in 2026 the European Data Protection Board chose these transparency obligations as the theme of a coordinated enforcement action by national supervisors. In the Netherlands that supervisor is the Autoriteit Persoonsgegevens (AP).

Where does the duty to publish a privacy statement come from?

Ọ dịghị otu isiokwu nke GDPR nke a na-akpọ "amụma nzuzo". Nkwupụta a bụ ụzọ nkịtị isi mezuo ọrụ GDPR na-akọwapụta n'ụzọ dị iche - dị ka ikike onye ọ bụla inwe ozi. Nghọta bụ ụkpụrụ dị na nka. 5 GDPR; nka. 12, 13 na 14 GDPR na-eme ka ọ bụrụ ndepụta ihe doro anya nke ihe ị ga-agwa ndị mmadụ, na ọkọlọtọ maka otu esi eme ya.

Nkewa dị n'etiti nka. 13 na nka. 14 dị mkpa karịa ka ọtụtụ ụlọ ọrụ si ghọta.

• Nka nke 13 GDPR na-emetụta ebe ị na-anakọta data nkeonwe site n'aka onye ahụ — fọm kọntaktị, ndenye aha, ndebanye aha akwụkwọ ozi. A ghaghị inye ozi ahụ oge ahụ a na-enweta data ahụ: tupu e nyefee fọm ahụ, ọ bụghị mgbe e mesịrị.
• Nka nke 14 GDPR na-emetụta ebe data ahụ si ebe ọzọ bịa — onye na-ere data, ndekọ ọha, isi mmalite e wepụrụ, onye mmekọ, ma ọ bụ onye were gị n'ọrụ. Ị ga-agwa onye ahụ n'ime oge kwesịrị ekwesị na n'ime otu ọnwa, ma ọ bụ na mkparịta ụka mbụ gị na ha, ma ọ bụ mgbe ekpughere onye nnata ọzọ data ahụ, nke ọ bụla buru ụzọ bịa.

Nkebi nke 14 nwere obere ihe ndị e kewapụrụ iche — onye ahụ enweelarị ozi ahụ, ịgwa ha na ọ gaghị ekwe omume ma ọ bụ ga-agụnye mgbalị na-ezighi ezi, iwu kwadoro inweta ma ọ bụ ikpughe ya nke ọma, ma ọ bụ na data ahụ dị n'okpuru nzuzo ọkachamara. Ndị a dị warara. "Ọ dịghị mma" abụghị mgbalị na-ezighi ezi, ụlọ ọrụ nke na-azụta ma ọ bụ na-ewepụ data kọntaktị ma na-agwaghị onye ọ bụla na-adabere na ihe e kewapụrụ nke na-adịghị adị.

Nkeji nke 12 GDPR na-achịkwa ụzọ : nkenke, doro anya, nghọta, dị mfe ịnweta, n'asụsụ doro anya na nke doro anya.

What must a privacy statement contain?

Nke a abụghị ndepụta nri. Nkwupụta na-efu otu n'ime ihe ndị a ezughi oke dịka iwu si dị.

Three items deserve a closer look, because that is where the AP’s attention lands.

Why isn’t “our partners” a good enough answer on recipients?

Nkebi nke 13 na nkebi nke 14 GDPR na-enye ndị nnata ma ọ bụ ụdị ndị nnata ohere. Nke ahụ bụ ezigbo nhọrọ, mana otu ga-abụrịrị ihe pụtara. "Ndị mmekọ anyị" abụghị otu; ọ bụ ịjụ ịza. "Onye na-enye ọrụ ịkwụ ụgwọ anyị, onye na-enye anyị nnabata na Germany, ikpo okwu ahịa email anyị na United States, na netwọk mgbasa ozi akpọrọ aha na nkwupụta kuki anyị" bụ. Ọ bụrụ na ịnweghị ike ịkọwa onye nnata na-enweghị nkọwa doro anya, o nwere ike ị maghị onye nwere data ahụ - nsogbu ka ukwuu.

What if you cannot give a fixed retention period?

GDPR kwetara na a naghị enye ọtụtụ ụbọchị mgbe niile, ọ bụ ya mere nka 13 ji kwe ka e mee ya ibiere used to determine the period instead. What it does not permit is the non-answer. In a 2023 decision fining Uber Technologies Inc. and Uber B.V. €10,000,000, the AP found exactly that: the statement said data would be kept as long as necessary, which it held too general. A workable criterion reads “for the duration of the contract and seven years after the last transaction, in line with Dutch tax law”.

What has to be said about transfers outside the EEA?

Saying data “may be transferred outside the European Economic Area” tells the reader nothing. In the same Uber case, the AP’s position was that the destination countries should be named and the safeguard identified — adequacy decision, standard contractual clauses, binding corporate rules — with how to obtain a copy. Companies using US analytics, CRM or cloud hosting are transferring; the only question is whether the statement admits it.

What form must the statement take?

Nkeji nke 12 GDPR na-esetịpụ ọkọlọtọ nke dị mfe ikwu ma na-ada ada mgbe mgbe:

• Nke dị nkenke ma doo anya — nke e gosipụtara nke ọma ma doo anya na ọ dị iche na usoro na ọnọdụ. Idebe ya n'ozuzu ya anaghị agbaso iwu.
• Nwere ọgụgụ isi — nke onye ọ bụla n'ime ndị a chọrọ ka ha bịa ghọta. Okwu e dere maka ndị ọkaiwu Amerịka adịghị mfe nghọta nye ndị Dutch na-azụ ahịa, ọ dịghịkwa okwu Bekee naanị na saịtị asụsụ Dutch.
• Ọ dị mfe ịnweta — onye na-agụ akwụkwọ ekwesịghị ịchọ ihe. Ntuziaka ndị Europe na-ewere ya dị ka ihe kwesịrị ịpụta ìhè ozugbo: njikọ kpọmkwem site na ibe ọ bụla, njikọ gburugburu ebe a na-anakọta ihe, na n'ime ngwa, ọ dịkarịa ala ugboro ole na ole.
• Asụsụ doro anya ma dị mfe nghọta — concrete and definitive rather than abstract. European guidance singles out hedging words such as “may”, “might” and “possible”, and treats phrases like “we may use your personal data to develop new services” or “for research purposes” as examples of what not to write.

Where a service is addressed to children, or you know children use it heavily, art. 12 requires vocabulary, tone and style to be adapted so a child can understand it. In the Netherlands this bites early: under art. 5 of the Uitvoeringswet AVG (the Dutch GDPR Implementation Act), the age below which parental consent is needed for information society services offered directly to a child is sixteen, the highest the GDPR allows. A statement written for adults on a service used by fourteen-year-olds fails, and the child’s own right to be informed is not discharged by informing the parent.

How does a layered privacy statement work?

Nha nha bụ azịza akwadoro maka esemokwu dị n'etiti izu oke na ịgụ ihe, ma ntuziaka AP na nke Europe na-akwado ya. Emechara nke ọma, oyi akwa mbụ na-ebu njirimara onye njikwa, ebumnuche, nhazi nwere mmetụta kachasị ukwuu ma ọ bụ ikike iju anya, na otu esi eji ikike eme ihe - yana ederede zuru oke otu pịa dị ka otu akwụkwọ.

Emeghị ya nke ọma, ọ na-aghọ ụzọ e si ezo ihe. Ogidi ekwesịghị ịdị iche n'etiti onwe ha, ozi zuru oke ga-anọgide n'otu ebe, a pụghịkwa ibelata ihe ọ bụla n'ihi na ọ na-eme ihere. Ọ bụrụ na ọrụ nhazi ga-eju onye na-agụ ya anya, nke ahụ bụ arụmụka maka oyi akwa mbụ, ọ bụghị nke anọ.

Where do privacy statements go wrong?

Mmebi ndị na-eme ugboro ugboro dị ole na ole, a na-atụkwa anya ha.

• Ebumnuche na-enweghị isi na nkesa a na-akọwaghị akọwa. "Iji melite ọrụ anyị" anaghị akọwa ihe ọ bụla, "anyị nwere ike ịkekọrịta data gị na ndị mmekọ ahọpụtara" bụ ntụpọ kachasị na ihe niile - ọ na-ezochikarị teknụzụ mgbasa ozi. Nnwale ahụ bụ ma onye na-agụ akwụkwọ nwere ike ịkọ ihe na-eme data ha ma kpebie ma ọ ga-ekwe omume.
• Nkwupụta nke megidere saịtị ahụ. This turns a paperwork problem into an enforcement problem. The statement says no tracking cookies are placed without consent while the tag manager fires on page load; it says data stay in the EU while the support desk runs on a US platform. A regulator does not need to read the statement carefully to find this. It needs to open the network tab.
• Nkwupụta e depụtaghachiri. A policy taken from a competitor describes the competitor’s processing: it names recipients you do not use, omits the ones you do, and states retention periods you do not observe. It is a set of false statements about your own business.

Is a privacy statement the same as a cookie notice?

No. These are two obligations under two instruments, and conflating them is a reliable way to comply with neither.

A na-achịkwa kuki na usoro ndị yiri ya na Netherlands site na nka nke 11.7a nke Telecommunicatiewet, na-emejuputa iwu nzuzo nke ePrivacy. Onye ọ bụla na-echekwa ozi na, ma ọ bụ na-enweta ozi echekwara na, ngwaọrụ njedebe nke onye ọrụ ga-enye ozi doro anya na zuru oke ma nweta nkwenye, yana obere mwepu maka ihe dị mkpa iji zipu nkwukọrịta ma ọ bụ nye ọrụ achọrọ. Nke a na-achịkwa omume nke ịgụ ma ọ bụ ide ihe na ngwaọrụ ahụ , ma ọ bụ na ọ metụtara ma ọ bụ na ọ bụghị. GDPR na-achịkwa ihe ị na-eme na data nkeonwe ọ bụla sitere na ya.

Ya mere: ọkọlọtọ ahụ bụ ebe a na-enye nkwenye ma ọ bụ jụ; nkwupụta kuki ahụ na-edepụta kuki, ebumnuche na oge ha; nkwupụta nzuzo ahụ na-akọwa nhazi nke data nkeonwe. Nkwupụta nzuzo enweghị ike ịnweta nkwenye, ọkọlọtọ enweghịkwa ike izipu nka. 13 na 14. Kpọọ ha aka, ma mee ka ha dịrị n'otu.

The AP has stepped up its monitoring of Dutch cookie banners since 2025, writing to organisations whose banners use pre-ticked boxes, an easier route to accept than to refuse, or options that are hard to find. Most organisations approached have since adjusted their banners; the AP has opened investigations into those that have not.

How do you build an accurate statement, instead of copying one?

Nkeji nke 30 GDPR chọrọ ka ọtụtụ òtù dị iche iche debe ndekọ nke ọrụ nhazi - verwerkingsregister . Maka ọrụ ọ bụla, ọ na-edekọ ebumnuche, ụdị nke isiokwu data na nke data nkeonwe, ndị nnata gụnyere ndị nọ na mba nke atọ, nchekwa mbufe na oge nchekwa. Ebe onye nnata bụ onye nhazi, otu eziokwu ahụ kwesịrị ịpụta na nkwekọrịta nhazi data na onye ahụ, nke na-eme ka ndebanye aha na nkwupụta dịkwuo mfe idobe.

Compare that with the table above: the overlap is nearly total. The register is the factual inventory; the privacy statement is its public rendering. Built in that order, the statement is accurate by construction and stays accurate, because updating the register updates the source. Written the other way round, the two drift apart — and a regulator that asks for the register and reads the website sees the gap.

How do you keep the statement current?

Nkwupụta nzuzo na-akọwa sistemụ dị ndụ, yabụ ọ na-akwụsị mgbe ọ bụla sistemụ ahụ gbanwere: ngwaọrụ nyocha ọhụrụ, CRM ọhụrụ, ihe nhazi ọhụrụ na mba ofesi, ebumnuche ọhụrụ maka data ejidelarị.

Two rules follow. A change of processing is a change to the statement, and it should be revised before the change goes live. And a material change must be actively communicated: European guidance is firm that leaving individuals to notice a revised policy themselves is not sufficient. Substantive changes — a new purpose, a change of controller, a change in how rights are exercised — should be brought to people’s attention by email or on-site notice, far enough in advance that they can withdraw consent or object. A typo needs no announcement. A new purpose does.

Dee ụbọchị maka nkwupụta ahụ ma debe ụdị ndị gara aga. Ọ bụrụ na ịchọrọ igosi ihe ị gwara onye ahịa na 2024, ibe dị ndụ nke na-agaghị agwụ agwụ agaghị eme ya.

Does the obligation apply to companies established outside the EU?

Ụlọ ọrụ na-enweghị ebe obibi EU na-ejide site na nka. 3 GDPR ma ọ bụrụ na ọ na-enye ngwaahịa ma ọ bụ ọrụ nye ndị mmadụ nọ na EU ma ọ bụ na-enyocha omume ha ebe ahụ. Nanị ịnweta weebụsaịtị ezughị; ihe dị mkpa bụ ihe akaebe nke ebumnuche - ụdị asụsụ Dutch, ọnụahịa euro, nnyefe na Netherlands, ngalaba .nl, mgbasa ozi Dutch. Nleba anya omume nke ndị ọbịa EU bụ ihe na-akpali onwe ya.

Ọ bụrụ na nkebi nke 3 metụtara, nkebi nke 27 GDPR na-achọkarị onye nnọchite anya na Union, nke e guzobere na steeti ndị otu ebe ndị data dị mkpa bụ ndị nwere njirimara na nkọwa kọntaktị ha dị na nkwupụta nzuzo. Mwepụ ahụ dị warara: nhazi nke na-abụkarị mgbe ụfọdụ, anaghị agụnye nnukwu data ụdị pụrụ iche, ọ gaghịkwa ekwe omume ibute ihe egwu. Ụlọ ahịa weebụ na-ere ahịa mgbe niile n'ahịa Dutch abụghị mgbe ụfọdụ.

The AP has enforced this in isolation, fining Locatefamily.com €525,000 for failing to designate an EU representative. The breach was of art. 27 read with art. 3 GDPR. The site had no EU establishment and its place of establishment was never firmly identified, which did not prevent the fine — a signal for any non-EU operator assuming distance equals immunity.

How does the AP enforce these rules?

N'okpuru edemede nke 6 nke Uitvoeringswet AVG, Autoriteit Persoonsgegevens bụ ikike nlekọta nke ndị Netherlands. Ike ya sitere na nka. 58 GDPR - ịdọ aka ná ntị, ịba mba, iwu, mmachi na nhazi - na nka. 83 GDPR na-etinye mmebi iwu nka. 12, 13 na 14 n'ọkwa dị elu maka ntaramahụhụ nchịkwa : ruo nde €20 ma ọ bụ 4% nke ngụkọta mgbanwe kwa afọ zuru ụwa ọnụ, nke ọ bụla dị elu.

The AP treats the information obligation as a standalone breach, not a footnote. Its €10,000,000 fine on Uber rested on arts. 12 and 13 GDPR — retention information too general, transfer destinations not named, the right to data portability not mentioned as such. That is a fine for what a privacy statement did not say. Separately, the AP fined Uber €290,000,000 in 2024 for transferring drivers’ data to the United States without a valid transfer tool.

The near-term risk is higher than usual. The 2026 coordinated enforcement action of the European Data Protection Board targets arts. 12, 13 and 14 GDPR directly: participating authorities approach controllers across sectors through investigations or fact-finding exercises, with follow-up where the findings warrant it.

Gịnị ka ị kwesịrị ịlele dịka azụmaahịa?

Compare your statement with what your website and systems actually do; that is how the AP tests it.

• Check that every purpose has a stated legal basis under art. 6 GDPR, and that legitimate interests are named where you rely on them.
• Name recipients or meaningful categories, not “our partners”, and match them against your processing agreements.
• Give a retention period or a usable criterion for each category of data.
• Name the countries outside the EEA you transfer to and the safeguard used for each.
• Check that the statement matches your cookie banner and the tags that actually fire under art. 11.7a Telecommunicatiewet.
• Version-date the statement and update it before a new tool or purpose goes live.

What can we do for you with your privacy statement?

Anyị Ndị ọkaiwu IT advise Dutch and foreign companies on the GDPR duty to inform.

• We review your current privacy statement against arts. 12, 13 and 14 GDPR and list the gaps.
• We draft a statement based on your register of processing activities (art. 30 GDPR).
• We check your cookie banner and cookie statement for consistency with the privacy statement.
• We assess whether you need an EU representative under art. 27 GDPR.
• We assist you when the AP sends questions or opens an investigation.

Summary

• The GDPR does not use the words “privacy policy”, but arts. 12, 13 and 14 make publishing one the only practical way to meet the duty to inform.
• Art. 13 applies to data collected from the individual; art. 14 to data obtained elsewhere, with its own timing rules and a narrow set of exceptions.
• The statement must be concise, intelligible, easily accessible and in plain language — vague wording on recipients, retention and transfers is where enforcement lands.
• Build the statement from your register of processing activities (art. 30 GDPR), not from a competitor’s policy or a generator, and revise it whenever the underlying processing changes.
• If you have no EU establishment but target the Dutch market, check whether you need an EU representative under art. 27 GDPR.

Ọtụtụ mgbe Ẹbụp Ajụjụ