Filing a complaint with the Autoriteit Persoonsgegevens

The Autoriteit Persoonsgegevens (AP) is the Dutch GDPR supervisory authority. Anyone can complain free of charge. When to complain? After you've tried with the business itself. The AP requires prior contact with the data controller (DPO or customer service) — typically a formal demand letter with a 2-4 week deadline. Response unsatisfactory or absent? Then complain. How? Via autoriteitpersoonsgegevens.nl → "Klacht indienen". Web form or letter (Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag). State: who violated your rights, what happened, which right was breached, what you've tried already, what evidence you have (emails, screenshots, correspondence). What does the AP do? Possible actions: conversation with the business, investigation, warning, order with penalty, fine (up to €20m / 4% turnover), or referral to another authority if outside NL. Not every complaint leads to investigation — the AP prioritises by severity and public interest. Timeline? Response within ~6 weeks, investigation can take months to years. Anonymous complaints? Not recommended — the AP can't come back for clarifying questions. You can request your name be kept confidential vis-à-vis the company. Other routes: civil court for damages (Art. 82). Netherlands Institute for Human Rights for discrimination. Sometimes a sector regulator (DNB for financial institutions, Nza for healthcare). Note: the AP doesn't handle disputes between citizens — only against data controllers (organisations).