Logo of the Dutch governmentGo to homepage

Government support for entrepreneurs

The General Data Protection Regulation (GDPR) step-by-step

This information is provided by

Netherlands Chamber of Commerce | Netherlands Enterprise Agency

The General Data Protection Regulation (GDPR) consists of a number of rules for the (automatic) processing of personal data. This new EU regulation forces you as an entrepreneur to act more carefully and responsibly when dealing with personal data of customers, personnel or others. Read this article to find out what the regulation means and how you can comply.

What is the GDPR?

The GDPR is a European privacy regulation. It ensures the careful processing of personal data by businesses and organisations. For instance, you must have a good reason to process personal data. And you are not allowed to gather and use more data than is absolutely necessary. These rules apply across the EU/EEA. In the Netherlands, the GDPR is referred to as the AVG or Algemene Verordening Gegevensbescherming.

Why was the GDPR introduced?

The GDPR was introduced to better protect everybody’s privacy. The GDPR forces entrepreneurs to handle personal data carefully, whether they be the data of clients, personnel or others. Businesses must be able to prove they abide by the GDPR.

Examples of personal data

Names and addresses, telephone numbers and postal codes and house numbers all constitute personal data. Sensitive data, f.i. someone’s race, sexual orientation, religion, or health, are called special personal data. It is not allowed to process special or criminal personal data, unless an exception has been made for you in the law.

Does the GDPR apply to your company?

The GDPR applies to all independent entrepreneurs who process personal data. It applies to you if you are a freelancer or a small business owner, even if you have no personnel or only have a few customers. You need to take into account the regulation’s conditions every step of the business process: even when sending a quotation, invoice or newsletter. It doesn’t matter if you process the data by hand or by an automated process; nor does it make any difference if you process the data on your own behalf or someone else’s. ‘Processing data’ includes: collecting, storing, using, forwarding, sharing, distributing and merging. If your business is located in one of the EU member states or in the EEA, even if only with a subsidiary or branch, or if your customers, suppliers or any other stakeholders are residents of an EU member state, you need to comply with the GDPR. The Dutch Data Protection Authority (DPA) checks that you comply with the GDPR. If they find you don’t, they may result issue a hefty fine.

File a complaint with the DPA Anyone who believes his or her personal data have been processed in a way that is not in accordance with the GDPR, can file a privacy complaint with the DPAExternal link (in Dutch).

The DPA has prepared a so-called 'Regelhulp AVGExternal link', a set of questions to quickly assess if your organisation complies with the GDPR. It is only available in Dutch.

10 steps for complying with the GDPR

You want to comply with the GDPR, but you are not certain how to go about it. Here are 10 steps to help you on your way.

1. Get informed about the GDPR and check if you are allowed to process personal data

Read about the GDPRExternal link, or attend an information session. Do you have personnel? Involve the relevant employees. They can assess the impact of the GDPR on your current processes, services and products. They can also determine what you need to do to comply with the GDPR.

To be allowed to process personal data, you must meet at least 1 of these 6 requirements:

  • You must have permission from the person involved.
  • You need the data in order to execute an agreement. For instance, you need address details to deliver your product to your customer.
  • You need the data in order to meet a legal obligation.
  • You need the data in order to protect someone’s life or health, and you cannot ask that person for permission.
  • You need the data to execute a task in the general interest.
  • You have a justified cause for processing the data. For instance, you must process personal data in your personnel records to be able to pay wages.

2. Inform your customers of their rights

Your customers have extensive privacy rights. You must enable them to execute these rights. For instance, your customers can:

  • View, edit and delete their data
  • Curb or withdraw any permissions previously given by them
  • Request their data to facilitate their move to a different company / services provider, this is called data portabilityExternal link (follow the link to download the EU guidelines on this page)
Your customers can lodge a complaint with the DPA. The DPA is obliged to deal with every complaint.

Draw up a clear privacy statement

Draw up a privacy statement in plain language. Tell the reader how and for what purpose you are using personal data. State why this is important (useful) for your customers, and for how long you will store the data. Make sure this privacy statement is easy to find.

3. Keep a record of your processing activities

You have to prove you are accountable for the way in which you process data. To do so, you are obliged to keep a record of how and why you process personal data. N.B.: If your company has fewer than 250 employees, you may not have to keep such a record (check the DPA position paperExternal link on this (PDF, in Dutch)). The record has to contain information on where the data come from, and who you share it with, so as to be able to notify the organisations you share data with of any changes or deletions of customer data.

Ask the customer’s permission if you outsource services

When you outsource services, and you share your customers’ personal data with another company, you will require your customers’ permission. For instance: when you hire an external call center or administrative office. Document in your customer agreement that you share their data, because it is relevant to the way in which you operate on their behalf.

4. Find out if you need to perform a Data Protection Impact Assessment (DPIA)

Do you process data with a high privacy risk? You will need to perform a Data Protection Impact Assessment (DPIA)External link. A DPIA is an extensive survey to chart the risks of data processing. Based on the DPIA, you can take measures to reduce the privacy risks. Are you unable to take risk reducing measures? Then confer with the DPA before you start processing the personal data. The DPA will determine whether the data processing is allowed according to the GDPR, or not. You will receive a written advice. You run a high privacy risk if you:

  • Evaluate personal aspects in a systematic and extensive manner, based on automatic processing, including profiling, and if on these evaluations you base decisions that have consequences for people
  • Process special personal data on a large scale, or process criminal data
  • Systematically follow people on a large scale in a public access area, for instance by using cctv
View a list of processing methods that require a DPIAExternal link (in Dutch).

5. Take privacy into account when designing new products or services

When you devise new products or services, ensure that personal data are already well-protected in the design phase. This is referred to as ‘privacy by design’. You shouldn’t process more personal data than absolutely necessary. This is referred to as ‘privacy by default’. Examples include:

  • An app shouldn’t record the user’s location without good cause
  • Don’t pre-check the ‘yes, I want to receive offers’ radio button on your website
  • Don’t ask for more information than necessary to record a subscription to a newsletter

6. Find out if you need a data protection officer

Does your company process data on a large scale? Then you may be obliged to employ a Data Protection Officer or DPOExternal link (follow the link for the pdf download to EU guidelines). A DPO is responsible for checking if your organization acts in accordance with the GDPR. Your organisation can also appoint a DPO voluntarily.

7. Document and report data leaks

A data leak means personal data are released that shouldn’t be. Examples are:

  • You lose a laptop, tablet, usb carrier or papers that contain non-encrypted personal data
  • You email personal data to the wrong person
  • The personal data you process are stolen in a cyber attack
  • Your system has been infected with ransomware, rendering the personal data inaccessible
You have to report every serious data leak to the DPA. Also, you must record and document every data leak in your organisation, even the internal ones that you do not have to report. View the guidelinesExternal link (PDF) to find out which data leaks to report. These guidelines have not been made final. You only have to notify the persons whose data are involved in the data leak, if it has serious consequences for their rights and freedoms. Do you process privacy-sensitive data on behalf of your clients? Then you will have the legal obligation to report any data leaks occurring during those processes to them, so they can notify the DPA.

8. Draw up a data processor agreement

Do you work with companies that process personal data on your behalf and following your instructions? Make sure you draw up a data processor agreement in accordance with GDPR Articles 28 and 29 (see the information on the DPA websiteExternal link). Even if the processing company is affiliated with your company, or based abroad. A help desk viewing the data constitutes a form of processing. Did you have a data processor agreement under the Protection of personal data Act (Wbp)? Be aware that the GDPR is stricter; most likely you’ll have to draw up a new agreement.

9. Determine the supervisor for your company

Is your organisation active in several European countries? Or do your data processing activities affect several EU member states? The GDPR requires you to deal with only one privacy supervisor, for instance the Dutch DPA. This is called the one-stop-shop mechanism.

10. Ask permission to process data

Some data processing activities require permission of the persons involved. Also, you have to be able to prove that the permission was given. It pays off to analyse the ways in which you request, acquire, and register people’s permission to process data.

This information is provided by

Netherlands Chamber of Commerce
Netherlands Enterprise Agency