Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Uitvoeringswet dataverordening (Data Regulation Implementation Act) in effect by 21 November 2026

21 November 2026

By 21 November 2026, the Dutch Data Regulation Implementation Act will be fully in effect, enabling supervision and enforcement of the European Data Regulation. This legislation grants individuals greater control over data from connected products, requiring organisations to facilitate access and sharing of this information.

The European Data Regulation, effective since September 2025, aims to empower consumers regarding data from connected products. In the Netherlands, the Uitvoeringswet dataverordening (Data Regulation Implementation Act) entered into force on 21 November 2025, establishing the framework for national supervision and enforcement. This means organisations handling data from smart devices must prepare for oversight by the Autoriteit Persoonsgegevens (AP) and the Autoriteit Consument & Markt (ACM).

The AP will supervise provisions related to the General Data Protection Regulation (GDPR), particularly concerning personal data sharing from connected devices and government data requests in emergencies. The ACM will act as the national data coordinator, overseeing how businesses provide consumers access to data from connected products, manage data sharing requests, and ensure transparency. Additionally, the ACM will supervise Dutch cloud services to facilitate switching and interoperability between providers. Organisations must ensure their data handling practices, especially regarding connected products and cloud services, align with the Data Regulation and GDPR principles, preparing for scrutiny on data access, sharing, and transparency.

Before 21 November 2026, organisations must have implemented mechanisms to grant users access to data generated by connected devices, established fair contractual agreements for data sharing, and simplified cloud service switching. Evidence of compliance will include transparent data collection policies, user friendly data access portals, and clear data sharing protocols.

The European Union's strategy to create a single market for data necessitates national implementation acts to enable effective supervision and enforcement by Member State authorities.

Data Regulation Implementation Act

Who this binds
Organisations handling data from connected products in the Netherlands
What changed
What is fixed is the date: 21 November 2026, when the Data Regulation Implementation Act entered into force in the Netherlands, enabling supervision of the European Data Regulation by the AP and ACM.
What to check
Prepare for supervision and enforcement of the European Data Regulation by Dutch authorities.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Organisations handling data from connected products in the Netherlands must prepare for supervision and enforcement of the European Data Regulation by 21 November 2026, as the Uitvoeringswet dataverordening is now in effect.

Today's question

A public sector organisation in the EU plans to deploy a new AI system for processing citizen applications, which is classified as high risk under the AI Act. What is a mandatory step this organisation must take before deploying the system, starting December 2027?

  1. Conduct a Data Protection Impact Assessment (DPIA) under GDPR Article 35.
  2. Perform a Fundamental Rights Impact Assessment (FRIA) as per the AI Act.
  3. Obtain prior authorisation from the European Data Protection Board (EDPB).
  4. Implement a 'privacy by design' approach and document it internally.

Answer this question on the site

Worth knowing

  1. EDPB adopts guidelines on anonymous data, web scraping, and blockchain

    Organisations using or developing AI systems, blockchain technologies, or anonymization techniques must review the EDPB's new guidelines to ensure compliance with GDPR requirements.

  2. Employers face new obligations under Automated Decision Making Technology (ADMT) laws

    Employers using AI or automated tools for hiring, promotion, or termination decisions must review new state specific ADMT laws to ensure compliance with notification, disclosure, and review requirements.

  3. Flock's design choices in license plate readers raise civil liberties questions

    Privacy professionals should consider the civil liberties implications of Flock's automatic license plate reader technology, particularly as cities evaluate its use and potential impact on public surveillance.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.