Dutch DPA Raises No Objections to Draft Mental Health and Forensic Care Regulation

Key Takeaways

• The Dutch Data Protection Authority (AP) reviewed the Dutch Healthcare Authority's draft Mental Health Care and Forensic Care Regulations (NR/REG-2705a) and issued no comments.
• The clean review suggests the draft's personal data processing provisions meet the AP's GDPR and proportionality framework.
• It also shows compliance teams how the AP tests health-related data processing in legislative proposals.

Deep Dive

The Dutch Data Protection Authority (AP) reviewed the Dutch Healthcare Authority's draft Mental Health Care and Forensic Care Regulations (NR/REG-2705a) and issued no comments. The clean review suggests the draft's personal data processing provisions meet the AP's GDPR and proportionality framework. It also shows compliance teams how the AP tests health-related data processing in legislative proposals.

The appendix is the more useful part for compliance teams. It sets out the AP's assessment framework, which tests whether a proposal complies with the EU Charter of Fundamental Rights, the GDPR, and the Police and Justice Directive (Directive 2016/680). This is relevant because forensic care can involve criminal justice data. The framework applies six proportionality criteria: suitability, subsidiarity, proportionality in the strict sense, legal certainty, substantive and procedural safeguards, and binding force under national law. The AP gives particular attention to GDPR Articles 5, 6(1) and 6(3), and 9, covering lawfulness, fairness, transparency, purpose limitation, data minimization, and special category data such as health data. It applies the equivalent provisions of Directive 2016/680 where relevant.

The only timeline is that the AP will publish the review on its website within two weeks of the letter. The letter sets no implementation dates, and the final entry into force of the regulation depends on the Dutch Healthcare Authority's own process. No new obligations arise directly from the letter. A "no comments" outcome is not a guarantee of compliance for individual organizations, since controllers and processors remain responsible for their own GDPR obligations.

Recommended actions: (1) Monitor the AP's publication and the final regulation text for any changes to data processing requirements for mental health and forensic care providers. (2) Confirm that data protection impact assessments, lawful basis and Article 9 condition documentation, and retention schedules for health data are current. (3) Where the organization is involved in policy or legislative engagement, use the six-criteria framework to pressure-test internal data processing justifications. (4) Check whether any forensic care activities fall under Directive 2016/680 rather than the GDPR. Overall risk impact is low, but the sensitivity of mental health and forensic data keeps regulatory and reputational exposure high if processing deviates from these principles.

Source: Netherlands Data Protection Authority