General data protection regulation

Also known as: AVG or General Data Protection Regulation(GDPR)

The General Data Protection Regulation (GDPR) is the privacy legislation in effect as of May 25, 2018. From that date, all countries belonging to the European Union will have the same privacy laws. The English name for this regulation is General Data Protection Regulation (GDPR).

In the Netherlands, the AVG replaces the previously applicable 2001 Personal Data Protection Act ( Wbp), which was based on the European Data Protection Directive.

In a world where our personal data is stored and processed in many files, the General Data Protection Regulation describes the duties of personal data processors and the rights of individuals whose data is stored and processed.

Basis, due diligence and reliefs

Thus, there must be a valid basis for the collection of personal data. Possibilities for this are consent of the user, vital interests, a legal obligation, an agreement or a general or legitimate interest. What must be met for these bases is described in more detail within the AVG.

In doing so, the AVG describes a number of criteria and tools related to due diligence in the collection and processing of personal data. For example, every organization that collects personal data must appoint a so-called data protection officer, who supervises the application of and compliance with the AVG. There must also be privacy by design, which includes not collecting more data than is strictly necessary. Organizations may also be required to conduct a Data Protection Impact Assessment, which identifies the risks of data processing.

Every organization is required to adopt a data protection policy that describes how the organization conforms to the AVG. Organizations may additionally be required to keep a register of all processing. This includes organizations for more than 25 employees and when processing special personal data such as religion and health. Of course, the collection, storage and processing of data must be properly secured.

Rights of data subjects

The AVG distinguishes several rights of individuals around the processing of their data. For example, they have the right to view or modify data. Furthermore, there are rights regarding the transfer of data from third parties and to be informed about the (manner of) processing of personal data.

Personal Data Authority

The Personal Data Authority is the Dutch regulator for the General Data Protection Regulation.