Dutch DPA Issues No-Objection Opinion on Data Governance Regulation Implementation Decree

Key Takeaways

• The Dutch Data Protection Authority has completed its mandatory GDPR Article 36(4) legislative review of the draft Data Governance Regulation Implementation Regulation and raised no objections.
• This clears a key regulatory checkpoint for the decree's progression, signaling that the Dutch government's approach to implementing the EU Data Governance Regulation aligns with GDPR principles and fundamental rights protections.

Deep Dive

This update reflects a routine but important step in the Dutch legislative process for implementing the EU Data Governance Regulation (Regulation (EU) 2022/868) at the national level. Under Article 36(4) of the GDPR, Dutch authorities are required to consult the Data Protection Authority (Autoriteit Persoonsgegevens, AP) whenever draft legislation involves the processing of personal data. In this case, the AP reviewed the draft Implementation Regulation and issued a formal opinion stating it has no comments, effectively a clean bill of health on data protection grounds.

For compliance teams, the substantive takeaway is less about new obligations and more about regulatory process transparency. The AP's assessment framework—detailed in the appendix—outlines the criteria regulators use when scrutinizing draft legislation: suitability, subsidiarity, proportionality, legal certainty, adequate safeguards, and binding national legal status. This framework is a useful reference point for compliance and legal teams assessing how Dutch and EU regulators evaluate data governance frameworks more broadly, and it may inform internal assessments of other pending EU/Dutch data-related legislation.

No specific implementation deadline is mentioned in this correspondence, though the review letter indicates the opinion will be published on the AP's website within two weeks (by approximately mid-September 2026). Organizations operating in the Netherlands and engaged in data sharing, data intermediation services, or data altruism activities under the EU Data Governance Regulation should monitor the Dutch Implementation Regulation as it moves through further legislative stages toward formal adoption, since it will define national-level procedural and institutional details (e.g., competent authorities, registration requirements, enforcement mechanisms).

Recommended actions include: (1) tracking the AP's published opinion and subsequent legislative developments on the Implementation Regulation; (2) reviewing the AP's proportionality/subsidiarity assessment framework for insights applicable to other data governance compliance reviews; (3) preparing for eventual designation of competent authorities and registration regimes for data intermediation service providers once the regulation is finalized; and (4) coordinating with EU subsidiaries or affiliates to ensure consistent approaches to Data Governance Regulation compliance across jurisdictions. Overall risk impact is low at this stage, as this is a procedural, non-objection opinion rather than a substantive change in obligations, but it signals forward momentum on a framework with future compliance relevance for data sharing and governance structures.

Source: Netherlands Data Protection Authority