Submitting a tip-off or a complaint to the Dutch DPA

You want to submit a tip-off or a complaint to the Dutch Data Protection Authority (Dutch DPA). This means that you have experienced something or that you suspect that a person or an organisation does not comply with the privacy law. It’s good that you want to do something about it. The Dutch DPA can help you with this in 3 steps.

We distinguish between a tip-off, a data breach tip-off and a complaint. We ask you read the information below with due care.

View the video on submitting a tip-off or a complaint (in Dutch)

Step 1: Do you have a tip-off or a complaint?

It is important that you choose the right option when you fill in the form, to ensure that your complaint or tip-off ends up with the right department and we can help you better.

Below you can read what the difference is between a complaint and a (data breach) tip-off and which option is your best choice in your case. Sometimes, submitting a tip-off or complaint to the Dutch DPA is not the best option, and a different solution is possible. Do you doubt whether you have to submit a complaint or tip-off? In that case, contact us.

Tip-off

• In the case of a tip-off, you suspect that an organisation does not comply with the privacy law.
• A tip-off may be about your own personal data, but also about someone else's.
• When submitting a tip-off, you do not have to leave your contact details. You are allowed to do this, though.
• The Dutch DPA assesses every tip-off received. Tip-offs help the Dutch DPA do its job. Submitting a tip-off is always useful. You do not receive any personal message about what we do with your tip-off.

Filling in the form takes about 10 minutes.

Data breach tip-off

• Do you have information about a data breach? Have you, for example, seen that there is a data breach at an organisation? Do you doubt whether that data breach has been handled correctly? Or do you suspect that your data have leaked? Then you can report this to the Dutch DPA with a data breach tip-off. 
• The Dutch DPA will then assess whether it concerns a data breach which should have been reported to the Dutch DPA by the organisation that has (experienced) the data breach. Reporting is not necessary for every data breach. If reporting is necessary, the Dutch DPA will check whether the organisation has already reported the data breach. If this is not the case, the Dutch DPA may contact the organisation. Your tip-off may also be a reason for the Dutch DPA to initiate an investigation.
• It is important that you pass on the possible data breach to the organisation itself first. An organisation can only do something about a data breach if it knows that there is one.

Filling in the form takes about 10 minutes.

Also read further action to be taken by you if you have become the victim of a data breach.

Have your data been passed on to another organisation without your consent? Then this is not a data breach, but another possible infringement of the GDPR. Do not submit a data breach tip-off in that case, but a tip-off or complaint. 

Note: has a data breach arisen at your own organisation, and do you want to report this to the Dutch DPA as a controller? Then view the information about the data breach notification obligation.

Complaint

• A complaint is about your own personal data, or those of your child. A complaint may also pertain to the personal data of someone for whom you have a power of attorney.
• When submitting a complaint, you fill in your data. The Dutch DPA will share your complaint with the organisation to which your complaint pertains, and also shares your identity in the process. After all, it is about your personal situation. Do you not want this to happen? Then submitting a tip-off is the better option.
• Do you submit a complaint? Then we will ask for proof, such as emails of other correspondence with the organisation. Such as the response of the organisation and/or the DPO. Do you add insufficient proof? Then we will ask you to do this at a later time. You can read in step 2 about the conditions that your proof also has to meet. 
• We expect that you have contacted the organisation for a solution first. For example through the Data Protection Officer (DPO), if the organisation has one. You indicate your complaint and the exact problem clearly. You can use an example letter (in Dutch) of the Dutch DPA for this purpose. Give the organisation 4 weeks to respond to your complaint.
• You will receive a personal message after we have assessed your complaint. In this message, we tell you what we will do or have done with your complaint.

Filling in the form takes about 15 minutes.

Tip: look for the privacy statement of the organisation on the website. And read what your privacy rights are. This will help you put your complaint into the right words.

Step 2: Preparing your notification

By preparing your notification, you can fill in the form more quickly. Therefore we recommend that you already have the following at hand:

• Evidence to support your tip-off or complaint, such as screenshots. The evidence should make clear what exactly your tip-off or complaint is about and what the problem is. You can read more about this in step 1.
• A copy of your contact with the organisation or the person to whom your complaint pertains. This shows that you first have sought contact with the organisation or person to solve the problem. For example by email or letter. You can read more about this in step 1.
• When you submit a complaint on behalf of someone else: a power of attorney. You can use this example (in Dutch) for that purpose. 

Note: Do not add information that is not relevant to your notification or that you do not want to share. You can make that information illegible. All information that you provide may be used by the Dutch DPA for conducting an investigation and legal proceedings. The Dutch DPA shares a copy of your complaint and our decision on your complaint with the organisation or the person to whom your complaint pertains. Under the Dutch General Administrative Law Act (Awb), we are obliged to do this. 

Step 3: Filling in the form

You can use the form to submit your tip-off, data breach tip-off or complaint step by step. You will find additional explanations to many questions under the ? sign.

We recommend that you fill in the form on a computer or laptop. This is easier on a big screen than on a smartphone or tablet.

Adjusting or withdrawing your complaint or tip-off

Maybe you want to adjust your earlier complaint or tip-off. For example because you have additional evidence now. Or you want to withdraw your earlier complaint or tip-off, because the situation has been resolved. You can do this in the form as well.

Privacy statement

When you submit a complaint or tip-off, we process your personal data. You can read in our privacy statement (in Dutch) how and why we do this.

Notification form

To the notification form (in Dutch) 

After your notification: This is what the Dutch DPA does with your tip-off or complaint

Tip-offs, data breach tip-offs and complaints are valuable for the Dutch DPA. They help us protect the personal data of people living in the Netherlands even better. That is why we look at every tip-off and complaint that we receive. Even if we do not investigate it any further, we can use your tip-off or complaint for our work. You can read more about this on the page Handling of complaints by the Dutch DPA. 

Did you submit a complaint about an international organisation? Then the Dutch DPA may handle your complaint in collaboration with other European supervisory authorities. As a result, handling the complaint may take longer.