Autoriteit Persoonsgegevens (AP)

What does the AP handle, in volume?

Complaints rose sharply. The AP received 13,500 complaints in 2025, a 75% increase on 2024, including 400 complaints tied to a single breach at Clinical Diagnostics affecting 850,000 people (AP, Rapportage klachten 2025, reported 8 June 2026). On breaches, the most recent full-year figure we could confirm is 37,839 notifications in 2024, of which 26,815 were followed up and 28 investigated in detail. Of those, 1,430 were caused by cyberattacks, 9% more than in 2023, at an average cost of 103,976 euros and a median of 30,000 euros (AP, Datalekkenrapportage 2024).

No published sector breakdown separates financial institutions from the total. We do not have that number and will not estimate it.

Which rules does the AP enforce, and where does the AI Act sit?

The AP enforces the GDPR and the UAVG. Its role under the EU AI Act in the Netherlands is not yet settled law. On 20 April 2026 the cabinet published a draft AI Act implementing act (Uitvoeringswet AI-verordening) for consultation, which closed on 1 June 2026. The draft designates ten market surveillance authorities, among them the AP, RDI, AFM and DNB (Rijksoverheid, 20 April 2026).

Under that draft, the AP takes prohibited practices, transparency obligations and high-risk AI in areas such as recruitment and benefits, while the AFM and DNB supervise AI inside their own financial-sector remits. The AP and RDI hold coordinating roles and are to launch a joint AI regulatory sandbox during 2026. As at 17 August 2026 the bill still has to pass both chambers.

For a bank or insurer, the practical reading is this: your AI Act supervisor is likely to be your existing financial supervisor, with the AP setting cross-sector interpretation.

What does the AP publish, and how often?

The AP publishes the AI and Algorithmic Risks Report Netherlands (RAN) twice a year, five editions so far, most recently in July 2025, plus an annual report, annual complaint and data-breach reports, guidance and normuitleg, fine decisions and consultations. The RAN is the publication to watch if you use AI: it sets out Dutch supervisory expectations on algorithms before they become enforcement.

What does the AP's enforcement look like, and where does it touch finance?

The AP's most consequential intervention for financial institutions is not a fine. On 14 July 2023 it wrote to the Ministry of Finance opposing the plan for continuous, centralised monitoring of transactions, a scheme it described as covering roughly 10 billion transactions a year from some 35 million clients. It called the plan a serious interference with the fundamental right to data protection, warned that pseudonymisation does not cure the proportionality problem, and flagged discrimination and exclusion risks (AP letter, 14 July 2023).

That letter is three years old and remains the AP's clearest published position on AML monitoring. It is the reason Dutch banks' joint transaction-monitoring plans have advanced slowly, and it is the tension a Wwft programme has to be designed around: the Wwft asks you to monitor, the GDPR asks you to justify how much.

What changes for a financial institution?

Three obligations sit next to your prudential ones. A personal data breach must be notified to the AP within 72 hours under GDPR Article 33, a clock that runs in parallel with, and on different criteria from, DORA major incident reporting to DNB or the AFM. A data protection impact assessment is required for high-risk processing under Article 35, which covers most large-scale customer profiling and transaction monitoring. And from 2 December 2027, credit scoring of natural persons and life and health insurance pricing become high-risk AI systems, supervised, on the current draft Dutch bill, by your financial supervisor rather than the AP.