Ready for the new UAVG?

On 1 September 2026, the Dutch Omnibus Data Protection Act (‘Verzamelwet Gegevensbescherming’, hereinafter: the “Act”) entered into force. This Act amends several laws relating to data protection, including the Implementation Act for the General Data Protection Regulation (in Dutch: ‘Uitvoeringswet AVG’, hereinafter: “UAVG”). Its aim is to update and modernise Dutch data protection law. That may sound dry, and at first glance it might well be, but several of the changes have direct implications for organisations. The most significant ones concern the processing of personal data relating to minors, the publication of enforcement decisions, and a revised definition of criminal data.

Wondering what exactly changes and what it could mean for your organisation? In this blog, we set out the key amendments.

Criminal data (Article 1 UAVG)

Stricter rules apply to criminal data than to ordinary personal data. Processing such data is in principle prohibited, unless a specific statutory exception applies and there is a valid legal basis for processing under Article 6 GDPR.

The Act amends the definition of criminal data in Article 1 of the UAVG. Previously, the definition also covered data relating to a court-imposed prohibition following unlawful or nuisance behaviour. The Act removes this element, meaning that such data will no longer automatically be classified as criminal data.

Young people gain greater autonomy (Article 5 UAVG)

The legislature seems to have taken the view that good habits start early. One of the most notable changes concerns the age at which young people may exercise control over their own personal data. Previously, the threshold for independently exercising GDPR rights was 16. In certain respects, that threshold has now been lowered to 12.

This means that:

• young people aged 12 and over may independently submit a request under Chapter III of the GDPR;

• young people aged 12 and over may independently withdraw consent to processing. The age of 16 continues to apply for giving consent; and

• parents or legal representatives may continue to exercise the rights of young people between the ages of 12 and 16 on their behalf.

The change reflects the principle that young people should have a say over their own personal data, without necessarily involving their parents.

If you work with personal data relating to minors, it is worth checking whether your procedures, forms, and privacy policy already reflect this new age threshold.

Mandatory publication of AP enforcement decisions (Article 21b UAVG)

The Dutch Data Protection Authority (AP) will now be required to publish its enforcement decisions. This is not entirely new, as the AP already did so under its own policy. Even so, the change brings a clear benefit: the systematic publication of enforcement decisions makes it easier and more transparent for organisations to understand how the AP interprets and applies the law.

Two conditions apply. First, a decision may not be published until ten working days after the organisation has received it. In addition, the organisation may appeal against both the decision itself and its publication.

Also new is that the AP will be required to consult interested parties before adopting new policy rules. This gives organisations a meaningful voice in how the AP interprets and enforces the GDPR.

Stricter requirements for the use of biometric data (Article 29 UAVG)

Using fingerprint scanning to clock in staff? Convenient, perhaps, but is it still permitted? The rules on the use of biometric data have been tightened. The UAVG already contained an exception allowing organisations to use biometric data for authentication or security purposes in certain circumstances. The Act narrows that exception.

Processing biometric data must not only be necessary for authentication or security. There must also be a substantial public interest in ensuring lawful access to buildings, services, products, information systems, and work processes. Organisations should therefore assess whether their current applications still fall within this exception.

Clear rules on the transfer of medical records (Articles 30a and 30b UAVG)

If your organisation deals with the transfer of patient records, the law now explicitly permits this without the patient's consent, provided the patient is informed of the transfer and their rights. Where informing patients individually would be disproportionately burdensome or is not permitted due to professional confidentiality obligations, the transfer must at minimum be announced in a timely manner and in general terms.

Parties that are not themselves healthcare providers also now have a statutory basis for transferring records. A trustee in bankruptcy who comes into possession of records from a discontinued medical practice, for example, may transfer those records to a healthcare provider or institution that will manage them going forward, provided appropriate safeguards are in place.

What does this mean for your organisation?

There is no need for alarm. You do not need to overhaul your entire privacy framework. That said, it is sensible for organisations to be aware of the implications of these changes and to adjust their practices where necessary.

If you have questions about what the Act means for your organisation in practice, please feel free to get in touch. We are happy to think it through with you.