Intra Group Data Processing Agreement Template for the Netherlands
Generate a bespoke document
What is a Intra Group Data Processing Agreement?
The Intra Group Data Processing Agreement is essential for corporate groups operating under Dutch law who need to establish compliant data processing arrangements between group entities. This document is required when one group entity processes personal data on behalf of another group entity, ensuring compliance with GDPR Article 28 requirements and Dutch data protection laws. It is particularly relevant for multinational groups with Dutch operations or Dutch-headquartered companies with multiple subsidiaries. The agreement should be implemented when group entities start sharing personal data processing activities and should be updated when processing activities change or new entities join the group. It includes specific provisions for security measures, data breach notifications, and audit rights, while taking into account the connected nature of group entities.
Frequently Asked Questions
Is an intra group data processing agreement legally binding in the Netherlands?
Yes, an intra group data processing agreement is legally binding in the Netherlands under both GDPR Article 28 and the Dutch GDPR Implementation Act. The agreement creates enforceable obligations between group entities and must meet specific contractual requirements set out in GDPR Article 28(3). Dutch courts will enforce these agreements as valid contracts when properly executed.
Can Dutch authorities fine my company if our intra group data processing agreement is missing or incomplete?
Yes, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) can impose substantial fines for missing or non-compliant intra group data processing agreements. Under GDPR Article 83, fines can reach up to €20 million or 4% of annual worldwide turnover, whichever is higher. Incomplete agreements that fail to meet Article 28(3) requirements are treated as non-existent by regulators.
How does Netherlands law affect intra group data processing agreements compared to other EU countries?
The Netherlands follows GDPR requirements but adds specific obligations through the Dutch GDPR Implementation Act (Uitvoeringswet AVG). Dutch law requires additional documentation for certain processing activities and has specific notification requirements to the Autoriteit Persoonsgegevens. The agreement must also comply with Dutch contract law principles and may need Dutch language versions for certain employee data processing.
How is an intra group data processing agreement different from a standard data processing agreement in the Netherlands?
An intra group data processing agreement applies specifically between entities within the same corporate group, while standard data processing agreements govern third-party relationships. Intra group agreements often include additional provisions for group-wide data governance, shared security measures, and streamlined breach notification procedures. They may also address internal data transfers that wouldn't apply to external processor relationships.
How long does it typically take to create an intra group data processing agreement for Dutch operations?
Creating a compliant intra group data processing agreement for Netherlands operations typically takes 2-6 weeks, depending on group complexity. This includes mapping data flows between entities, identifying processing activities, conducting legal review, and obtaining necessary approvals. Complex multinational groups may require additional time to address cross-border transfer mechanisms and varying local requirements.
Can Dutch group entities share personal data without a written intra group data processing agreement?
No, Dutch group entities cannot legally share personal data for processing without a written agreement meeting GDPR Article 28 requirements. Even within the same corporate group, the Dutch Data Protection Authority treats intra-group data sharing as processor relationships requiring formal contracts. Verbal agreements or informal arrangements do not satisfy legal requirements and expose the group to regulatory action.
Which mistakes make intra group data processing agreements non-compliant under Netherlands law?
Common compliance failures include missing mandatory Article 28(3) clauses, inadequate data transfer safeguards for non-EEA group entities, unclear processor instructions, and insufficient security requirements. Many agreements also fail to address Dutch-specific requirements like employee data processing rules and proper breach notification procedures to the Autoriteit Persoonsgegevens within required timeframes.
About the Intra Group Data Processing Agreement
When your corporate group operates across multiple entities in the Netherlands, you need clear legal frameworks for sharing and processing personal data between group companies. An Intra Group Data Processing Agreement ensures your organization meets GDPR requirements while facilitating necessary business operations across your corporate structure.
When do you need this document?
You require this agreement when your group holding company needs subsidiaries to process personal data on its behalf, such as when your shared service centers handle HR data for multiple group entities. It's essential when your regional headquarters coordinate data processing activities across local operating companies, or when your group IT services entity manages customer databases for various business units. The agreement becomes critical during mergers and acquisitions when integrating new entities into existing data processing arrangements, and when establishing new subsidiaries that will handle personal data for other group companies.
Key legal considerations
Your agreement must clearly define the controller-processor relationship between group entities, specifying processing purposes, data categories, and retention periods. You need robust security measures that meet GDPR standards, including technical and organizational safeguards appropriate to the processing risks. Data breach notification procedures must ensure compliance with the 72-hour reporting requirement to supervisory authorities and data subject notification obligations. The agreement should include detailed provisions for data subject rights, including how requests will be handled across group entities. You must establish clear audit rights and regular review procedures to ensure ongoing compliance. Consider including specific clauses addressing data transfers between group entities in different jurisdictions and ensure appropriate safeguards are in place.
Legal requirements in Netherlands
Under Dutch law, your agreement must comply with GDPR Article 28 requirements as implemented by the Dutch GDPR Implementation Act (UAVG). The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) expects written contracts between controllers and processors, even within corporate groups. Your agreement must specify the subject matter, duration, nature and purpose of processing, and include binding instructions for the processor. Dutch civil law principles under the Burgerlijk Wetboek apply to contract formation and interpretation, requiring clear terms and mutual obligations. If your data processing involves telecommunications services, additional requirements under the Dutch Telecommunications Act may apply. You must ensure the agreement addresses liability allocation between group entities and includes provisions for regulatory cooperation with Dutch authorities during investigations or audits.
GOVERNING LAW
Applicable law
This Intra Group Data Processing Agreement is drafted to comply with Netherlands law. Key legislation includes:
Dutch GDPR Implementation Act (UAVG): The Dutch law implementing GDPR (Uitvoeringswet Algemene verordening gegevensbescherming), which provides specific national rules and derogations allowed under GDPR.
Dutch Civil Code (Burgerlijk Wetboek): Relevant for contract law principles and requirements, particularly Book 6 on general contract law that would apply to the agreement structure.
Dutch Telecommunications Act: May be relevant if the data processing involves electronic communications services or networks within the group companies.
EU Standard Contractual Clauses (SCCs): While primarily for international transfers, these provide valuable guidance for intra-group data processing standards, especially if any group entities are outside the EEA.
Dutch DPA Guidelines: Specific guidelines and recommendations issued by the Autoriteit Persoonsgegevens regarding data processing agreements and intra-group data sharing.
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it