meta_id 3214869

On June 4, 2026, the Autoriteit Persoonsgegevens (AP), the Netherlands' personal data protection authority, established a formal process description for enhanced supervision. The AP identified a need for supervisory oversight that is more intensive than standard system supervision in its regulatory practice. Enhanced supervision is a supervisory instrument designed to enable the AP to redirect organisations in a timely manner and encourage improved compliance with the General Data Protection Regulation (GDPR). The AP intends to use this approach to prevent the need for enforcement action and financial penalties. Enhanced supervision forms part of the AP's supervisory powers but does not involve the use of enforcement powers. The AP may implement enhanced supervision when an enforcement process is either undesirable or not feasible, but the organisation in question still requires encouragement to achieve better GDPR compliance. The process description outlines what enhanced supervision entails, the circumstances in which the AP will deploy the instrument, and the procedural steps involved. The AP drew on practical experience gained from previous enhanced supervision implementations, including a case involving the municipality of Eindhoven. In that instance, the AP successfully concluded the enhanced supervision after the municipality achieved sufficient improvement in its overall compliance level with privacy legislation and regulations. The process description is now available for public consultation and provides detailed guidance for organisations and stakeholders on how enhanced supervision will operate. This formalisation of the enhanced supervision framework represents the AP's commitment to balancing preventative oversight with enforcement action in its regulatory approach to data protection compliance across the Netherlands.