Data Privacy Addendum Template for the Netherlands

A Data Privacy Addendum is a crucial legal document that supplements your existing service agreements when personal data processing is involved under Netherlands law. This addendum ensures your business relationships comply with the EU General Data Protection Regulation (GDPR) and Dutch privacy legislation, establishing clear obligations between data controllers and processors.

When do you need this document?

You need a Data Privacy Addendum whenever your business relationship involves processing personal data on behalf of another party in the Netherlands. This typically occurs when you engage cloud service providers, marketing agencies, IT support companies, or any third-party service that handles personal data for your organization. The addendum is also essential when you provide services that involve processing client data, such as payroll services, customer relationship management, or data analytics. Under Dutch law, any controller-processor relationship requires a written agreement that meets GDPR standards, making this addendum legally mandatory rather than optional.

Key legal considerations

Your Data Privacy Addendum must address several critical elements to ensure GDPR compliance. The document should clearly define the scope and purpose of data processing, specify the categories of personal data involved, and identify the types of data subjects affected. Security measures are particularly important, requiring detailed technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. The addendum must also establish procedures for data breach notifications, ensuring both parties can meet the 72-hour reporting requirement under GDPR. Additionally, you need to address data subject rights, including how individuals can access, correct, or delete their personal data, and establish clear procedures for handling such requests.

Legal requirements in Netherlands

Under Netherlands law, your Data Privacy Addendum must comply with both GDPR and the Dutch GDPR Implementation Act (UAVG). The document must specify the lawful basis for processing and ensure any international data transfers use appropriate safeguards, such as EU Standard Contractual Clauses. Dutch law requires specific attention to data retention periods, with clear deletion schedules that align with the purpose limitation principle. The addendum should also address the appointment and role of Data Protection Officers where required, and establish jurisdiction for any disputes under Dutch Civil Code provisions. For telecommunications and electronic communications data, additional requirements under the Dutch Telecommunications Act may apply. The document must be written in clear language that both technical and non-technical stakeholders can understand, and should include schedules detailing approved sub-processors, processing activities, and security measures.