Contact: Autoriteit Persoonsgegevens (Dutch DPA)

For what? All complaints about GDPR rights violations by organisations — businesses, government, schools, healthcare providers, freelancers, associations. Includes: non-response to requests, unreported data breaches, illegal camera surveillance, unsolicited marketing, data sharing without basis. What the AP does NOT do: Disputes between citizens (neighbour vs neighbour without organisational context — those go to court). Damages claims (also court). Sectoral complaints (financial → AFM/DNB, healthcare → IGJ, education → Onderwijsinspectie secondarily). Before complaining: the AP requires prior contact with the business/organisation. Send a formal demand letter with 2-4 week deadline first. Only after no/unsatisfactory response: file complaint. How long? Confirmation within ~6 weeks. Handling: weeks to months. Investigation: can take years. Anonymity: not recommended — AP can't come back for clarification. You can request your name be withheld from the respondent. Fines: the AP issued hundreds of millions in fines 2024-2025 — TikTok €750k, Booking.com €475k, Uber €290m (latter via international cooperation).