Something changed in Dutch privacy law this month that is easy to miss, because it is not about what you have to do. It is about what happens when you don't.
Since 1 September 2026 the Dutch Data Protection Authority — the Autoriteit Persoonsgegevens, the national supervisory authority that enforces the GDPR in the Netherlands — has been obliged to publish any sanction it imposes. With the name of the organisation attached. Before that it did so of its own accord, under its own policy; now it is written into law.
Updated on 7 September 2026: the amendment actually entered into force on 1 September — the text is now in the present tense. Added: the procedure the authority describes in its announcement of 27 August 2026, and the fact that it now publishes sanctions under the Dutch police data and judicial data acts the same way.
For most event organisations nothing changes about the rules themselves. What changes is the scale you weigh them on.
What has actually been put into the law
The change comes from the Verzamelwet gegevensbescherming, an omnibus act that tidies up and extends the Dutch GDPR Implementation Act (UAVG). The text is in Bulletin of Acts 2026, 154; the commencement decree brings it into force on 1 September 2026, with the exception of one clause that still needs supplementing.
The new Article 21b is short. The authority publishes a decision imposing an administrative sanction, "except insofar as Article 5.1 (…) of the Open Government Act stands in the way of publication". Three things are packed into that:
- It covers administrative sanctions. A fine, then, but also an order subject to a penalty payment or a processing ban. Not every measure the authority takes is an administrative sanction — a reprimand, for instance, is not.
- Publication is the rule, not a choice. Where the authority previously weighed it up case by case, publishing is now the starting point.
- The Open Government Act remains the brake. Commercially confidential information and the personal data of individual employees get redacted.
That follows the course the authority had already set. In March 2026 it adopted new publication policy rules built on the principle "public, unless". The statute now extends that line.
Ten working days, and what you can do with them
There is a pause between the decision and publication. The authority may only publish once ten working days have passed since the day the decision was served on the offender. That period lapses if you have gone public yourself — an organisation that tells its own story first does not have to wait for the regulator.
If within those ten working days you apply for interim relief at the administrative court, publication is suspended until the judge has ruled. That is not an escape route, but it is a real safeguard: you can have a publication tested before it goes live. Under the fourth paragraph the same regime applies to a decision on objection that upholds the sanction.
In its announcement of 27 August 2026 the authority sets out how this works in practice: it first tells an organisation that it intends to publish and gives it the chance to respond, then takes a final decision on publication, and only then publishes. You can object both to the sanction and to its publication. If you state that you have no objections, or you have already gone public yourself, the authority may publish sooner.
It is drawing that line wider than the GDPR, too: with the amended publication policy it will now publish sanctions under the Dutch Police Data Act and the Judicial Data Act in the same way.
How high can a GDPR fine actually be?
Now that the amounts go online with a name attached, "how high can a GDPR fine be" is a less theoretical question. The answer has two layers.
The statutory ceilings sit in Article 83 of the GDPR and they are high: up to €10 million or 2 percent of worldwide annual turnover for the lighter category of infringements, and up to €20 million or 4 percent for the gravest — in both cases whichever amount is higher. Those are ceilings for the extremes, not guide amounts.
How the Dutch authority arrives at a figure depends on who is in front of it. For undertakings it calculates with the EDPB Fining Guidelines; for government bodies and for private individuals not acting on behalf of a company, with its own 2023 fining policy rules. That split gets mixed up constantly: the category tables with bandwidths you read about online do not apply to everyone.
And the bottom end is arguably the most instructive. In July 2025 the authority fined Stichting Oud Lemmer €500 — a volunteer heritage foundation that had been livestreaming webcam footage of its village since 2019 without a lawful basis, with people and buildings recognisable in shot. On top of the fine came an order subject to a penalty payment: within four weeks, move the cameras, blur the footage or stop.
Five hundred euros will not topple a foundation. But it is exactly the kind of organisation everyone assumes the authority never looks at, and since 1 September a decision like that goes online with the foundation's name on it. That is this amendment in a single example.
How likely is this to touch you?
Honest answer: a fine is unlikely. The authority issued four fines in 2025, against six in 2024, and gave nine reprimands. Complaints and tip-offs rose by 75 percent, but the regulator shifted visibly towards warning, advising and investigating. A village festival or a brass band is not high on that list — though Lemmer shows that “not high on the list” is not the same as “out of view”.
Except: most organisations do not meet the authority through a fine. They meet it through the data breach notification desk. And there the numbers are far less theoretical. From the authority's 2025 data breach report:
- Over 39,000 notifications in 2025, against nearly 38,000 in 2024.
- More than 25,000 of those concerned post — largely misaddressed.
- More than 4,200 concerned email, mostly addressing errors.
- 2,400 concerned cyberattacks, over 1,700 of which were compromised accounts. In 2024 that figure was 607. Close to a threefold rise, and the authority points squarely at AI phishing: faster, more convincing and at scale.
Put those two lists side by side and the picture is clear. The risk to an event organisation rarely sits in some principled legal misstep. It sits in a wrongly addressed email and a stolen login.
Where events go wrong
Three situations we see most often, and what to do about them.
The attendee list in the cc field. You send a final update to a hundred and fifty attendees and put the addresses in cc instead of bcc. That is a data breach: a hundred and fifty people now see each other's email address, tied to the fact that they are coming to your event. For a private or sensitive event that is more than a cosmetic slip. It is also precisely the category the authority receives most. The structural fix is not "pay closer attention" but making manual emailing unnecessary — mailing from your ticketing system sends per recipient, and at MijnEvent email addresses are masked by default from anyone who does not need them.
The shared account. One login the whole committee uses, with a password unchanged since 2021. If that account is taken over you cannot even establish who did what. Give every team member their own access and exactly the permissions their role calls for — a volunteer scanning tickets has no business exporting visitor data.
The list that never goes away. The attendee export from the 2021 festival is still in a shared folder and nobody remembers why. Retention periods are the dullest part of the GDPR and simultaneously the most effective: data you no longer hold cannot leak. Our overview of the GDPR for event organisers sets out a reasonable period per data type.
And when a visitor asks what you hold on them, or wants it erased: handle it within a month. Handling a GDPR request explains how.
Why a published sanction weighs differently
A fine is money. Unpleasant, but you can budget for it. A published decision is something else: it is out there, with a date and a name, and it stays findable. For an event organisation that is an unusually heavy penalty, because you work with parties who judge you on trust. The council that grants your permit. The sponsor who puts their logo on your banner. The association considering handing you its membership administration.
Which is exactly what the legislator intended: visibility, a deterrent effect, and organisations able to learn from each other's cases. That last part is the most useful side of it for you. Public decisions also mean public norms: you will be able to read what the authority genuinely considered a step too far, instead of guessing.
What you can do this month
No big project. Four things that fit in one morning:
- Find out where your visitor data lives. Not just in your ticketing system — also in exports, mailing lists, WhatsApp groups and the treasurer's laptop.
- Throw away what you no longer need. Every old export you delete is a data breach that can no longer happen.
- Give everyone their own login with their own permissions, and switch on two-factor authentication where you can. That is the direct countermeasure to the fastest-growing category of breaches.
- Agree who does what when it goes wrong. You have 72 hours to report a breach. That is enough time, but not if you spend the first hours working out whose job it is.
At MijnEvent part of this sits in the product: masked email addresses, permissions per team member, an activity log recording who did what and when, and retention periods that expire on their own. No supplier takes over your responsibility — you remain the controller — but it matters whether your system thinks along with you or works against you.
See what MijnEvent costs or create your organiser account; you can be selling your first ticket the same week.
This article is general information, not legal advice. The published statutory text governs your specific situation; consult a lawyer or the Dutch Data Protection Authority if you are in any doubt.
Legislation changes and tariffs are revised annually. We do our best to keep this article current and link to the source where we can, but we cannot guarantee everything still holds at the moment you read it. If a decision carries financial or legal consequences, check with the authority itself or put it to a lawyer or adviser. See also our general disclaimer.
