The Netherlands' four largest confirmed GDPR fines since 2024 total EUR 423.2 million, according to PrivacyTerms.io's compilation of Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) decisions and the CMS GDPR Enforcement Tracker Report 2026. One case drives most of that total: Uber's record EUR 290 million penalty for shipping European drivers' data to the United States without adequate safeguards. Three more fines, against a Russia-linked ride-hailing operator, a facial-recognition company, and a credit bureau, make up the rest.
How much have the Dutch DPA's biggest GDPR fines totaled since 2024?
Four confirmed cases make up the EUR 423.2 million total: Uber's EUR 290 million fine in July 2024, MLU B.V.'s (Yango) EUR 100 million fine in April 2026, Clearview AI's EUR 30.5 million fine in September 2024, and Experian Nederland's EUR 2.7 million fine in 2025. All four were decided by the Dutch DPA, the supervisory authority responsible for enforcing the GDPR inside the Netherlands.
Figure 1: The four largest confirmed Dutch DPA GDPR fines since 2024. Source: Dutch DPA decisions, CMS GDPR Enforcement Tracker Report 2026, compiled by PrivacyTerms.io.
The gap between the largest and smallest case is enormous: Uber's fine is more than 100 times the size of Experian's. That gap is the reason a single case can move the country's entire enforcement total.
What is the largest GDPR fine the Dutch DPA has ever issued?
EUR 290 million is the largest fine the Dutch DPA has ever imposed. The AP issued it against Uber Technologies Inc. and Uber B.V. on July 22, 2024, for transferring the personal data of European taxi and delivery drivers to the United States without the safeguards Articles 44 and 46 of the GDPR require, a violation the AP said continued for more than two years.
Uber's case is not just a Dutch record. It also sits among the 10 largest GDPR fines issued anywhere in Europe, alongside penalties against Meta, Amazon, and TikTok, according to enforcementtracker.com's running list of the largest confirmed GDPR fines on record.
Why did the Dutch DPA fine Yango's parent company EUR 100 million?
The Dutch DPA fined MLU B.V., the Dutch operator of the Yango ride-hailing and taxi app, EUR 100 million in a decision dated April 1, 2026, and announced by the AP on May 8, 2026. The violation involved transferring large volumes of Norwegian and Finnish users' personal data to servers in Russia, a transfer the AP found unlawful even though MLU B.V. relied on Standard Contractual Clauses, the same transfer mechanism many companies use to justify sending data outside the EU.
Figure 2: The confirmed Dutch DPA fine total after each of the four cases, in chronological order. Source: Dutch DPA decisions, compiled by PrivacyTerms.io.
Cross-border transfer failures now account for two of the Netherlands' four largest fines and more than 92% of the combined EUR 423.2 million total. This mirrors the pattern GDPR enforcement shows across the continent as a whole; see our GDPR fines statistics for 2026 for the EU-wide totals and how transfer violations rank against other categories.
How does the Netherlands compare to the rest of the EU?
The Netherlands' EUR 423.2 million confirmed total is a small share of Europe's overall GDPR enforcement picture. Cumulative GDPR fines across 32 tracked countries reached roughly EUR 6.31 billion across 3,202 cases as of August 4, 2026, according to enforcementtracker.com, which puts the Netherlands' confirmed total at about 6.7% of that EU-wide figure.
Figure 3: The Netherlands' confirmed fine total as a share of the EU-wide cumulative GDPR fine figure. Source: enforcementtracker.com, updated August 4, 2026.
Case volume tells a different story than the total does. The Netherlands ranks around 15th among the 20 most enforcement-active jurisdictions tracked, well behind Spain, Italy, and Romania on activity, even though one Dutch case sits inside Europe's top 10 fines by size.
Which single case makes up the biggest share of the total?
Uber's EUR 290 million case accounts for 68.6% of the Netherlands' EUR 423.2 million confirmed total on its own. MLU B.V.'s Russia-transfer fine adds another 23.6%, and the two remaining cases, Clearview AI and Experian Nederland, together make up the final 7.8%.
Figure 4: How the Netherlands' EUR 423.2 million confirmed total breaks down by case. Source: Dutch DPA decisions, compiled by PrivacyTerms.io.
Sites that move personal data across borders, whether to the United States, Russia, or anywhere outside the EU's adequacy list, carry the single biggest share of Dutch enforcement risk right now, ahead of domestic issues like credit-scoring transparency or biometric data collection.
If your site collects data from visitors in the Netherlands or elsewhere in the EU, an outdated or missing international-transfer disclosure is one of the fastest ways onto this list. A privacy policy generator built for GDPR keeps that disclosure current without waiting for a regulator to flag the gap.
How do the Netherlands' four biggest GDPR fines compare?
| Company | Fine amount | Decision date | Violation |
|---|---|---|---|
| Uber Technologies / Uber B.V. | EUR 290,000,000 | July 2024 | Unlawful transfer of driver data to the US (Art. 44/46) |
| MLU B.V. (Yango) | EUR 100,000,000 | April 2026 | Unlawful transfer of user data to Russia despite SCCs |
| Clearview AI | EUR 30,500,000 | September 2024 | Facial-recognition database scraped without a legal basis |
| Experian Nederland B.V. | EUR 2,700,000 | 2025 | Credit-scoring data used without adequate transparency |
| Combined total (4 cases) | EUR 423,200,000 | -- | -- |
Source: Dutch DPA decisions and press releases, CMS GDPR Enforcement Tracker Report 2026, compiled by PrivacyTerms.io.
Three of the four cases involve moving personal data outside the Netherlands entirely, either to the United States or to Russia. Only Clearview AI and Experian's violations stem from what the companies did with data they already held.
The Bottom Line
EUR 423.2 million across four confirmed cases is a genuine enforcement record for the Dutch DPA, but the total tells a narrower story than it first appears. Uber's single EUR 290 million case accounts for more than two-thirds of the figure, and cross-border data transfers, not routine privacy-policy gaps, drove the two largest fines. For most businesses collecting data from Dutch or EU visitors, the practical exposure looks less like Uber's case and more like Experian's: a transparency failure that is fixable with a current, accurate privacy disclosure before a regulator finds the gap rather than after.
Frequently Asked Questions
How much has the Dutch DPA fined companies since 2024? EUR 423.2 million across four confirmed cases, according to PrivacyTerms.io's compilation of Dutch DPA (Autoriteit Persoonsgegevens) decisions and the CMS GDPR Enforcement Tracker Report 2026: Uber (EUR 290 million), MLU B.V. / Yango (EUR 100 million), Clearview AI (EUR 30.5 million), and Experian Nederland (EUR 2.7 million).
What is the largest GDPR fine the Dutch DPA has ever issued? EUR 290 million, issued against Uber Technologies Inc. and Uber B.V. on July 22, 2024, for transferring European drivers' personal data to the United States without adequate safeguards under Articles 44 and 46 of the GDPR.
Why did the Dutch DPA fine Yango's parent company EUR 100 million? The Dutch DPA fined MLU B.V., which operates the Yango ride-hailing app, EUR 100 million on April 1, 2026, for unlawfully transferring Norwegian and Finnish users' personal data to servers in Russia despite relying on Standard Contractual Clauses.
How does the Netherlands compare to the rest of the EU on GDPR fines? The Netherlands' EUR 423.2 million confirmed total is roughly 6.7% of the EU-wide cumulative GDPR fine total of about EUR 6.31 billion across 3,202 cases, according to enforcementtracker.com as of August 2026, and the Netherlands ranks around 15th among the 20 most enforcement-active jurisdictions tracked.
Where the Numbers Come From
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Netherlands." Country breakdown covering the Dutch DPA's Uber (EUR 290 million, July 2024) and Experian Nederland (EUR 2.7 million) cases, published May 21, 2026.
- enforcementtracker.com. GDPR Enforcement Tracker database. EU-wide cumulative total of EUR 6,308,868,904 across 3,202 cases in 32 countries, the Netherlands' rank among the 20 most active jurisdictions, and Uber's case among the 10 largest confirmed GDPR fines on record, data updated August 4, 2026.
- Autoriteit Persoonsgegevens (Dutch DPA). (2026). "AP Fines Taxi App Yango EUR 100 Million." Official decision announcement, May 8, 2026, for a decision dated April 1, 2026.
- Autoriteit Persoonsgegevens (Dutch DPA). (2024). "Besluit boete Clearview AI." Official fine decision, September 3, 2024, EUR 30.5 million plus conditional penalties of up to EUR 5 million.
Note: All figures verified as of October 2026. The EUR 423.2 million combined total is PrivacyTerms.io's own compilation of the four Dutch DPA decisions listed above, cross-checked against the CMS GDPR Enforcement Tracker Report 2026's Netherlands country breakdown. Dutch DPA fine data is refreshed at least twice a year as the AP publishes new decisions.
