What is the UAVG (Dutch GDPR Implementation Act)?

The Dutch GDPR Implementation Act (UAVG) entered into force on 25 May 2018 (alongside GDPR) and provides the Dutch implementation of matters the EU regulation explicitly leaves to member states. Not "a Dutch GDPR" — that's prohibited — but a supplement where needed. Key UAVG provisions: Art. 5 — age limit for digital consent: children under 16 need parental consent for information-society services (the EU leaves this 13-16). Art. 22 onwards — minors, representation, journalistic exemption. Chapter 3 (Art. 30-46) — exceptions for special category data: healthcare, social security, police, justice get Netherlands-specific exceptions for processing health data, ethnicity (police), religious data (institutions). Art. 43 — criminal data: only government + by AP licence also financial sector (KYC, fraud database Section 21). Chapter 5 — enforcement + sanctions: AP decision structure, objection + appeal, fine categories. Chapter 6 — transitional provisions + repealing old Wbp. BSN regulation: separately regulated in Dutch BSN Act (Wabb), not in UAVG itself — but read together. Journalistic exemption: UAVG Art. 43 declares most GDPR rights + duties not applicable to processing solely for journalistic, academic, artistic or literary purposes. Important for press + content creators. Difference vs GDPR: GDPR = EU level, directly applicable, identical across all 27 member states. UAVG = NL supplement only where GDPR offers opening clauses. On conflict: GDPR prevails.