Since the introduction of the GDPR (AVG in Dutch), organisations have had a legal obligation to protect personal data properly. But the law is often abstract and difficult to translate into practice. That is where the Data Pro Code comes in.

The Data Pro Code is a code of conduct recognised by the Dutch Data Protection Authority (AP). It provides a practical framework for the responsible processing of personal data. By adhering to the code, you demonstrate that you are actively working on compliance and data protection.

What does the Data Pro Code contain?

The Data Pro Code is divided into several themes that cover the most important aspects of data protection. For each theme, there are concrete rules and best practices that you can apply directly within your organisation.

Lawfulness of processing

You must have a valid basis for processing personal data. Think of consent, contractual necessity, legal obligation or legitimate interest. The code helps you determine which basis is appropriate for each situation.

Transparency and information

Data subjects have the right to know what happens to their data. The code provides guidance on how to formulate privacy statements and cookie notices so that they are actually understandable.

Data subject rights

People have the right to access, rectify, delete or transfer their data. The code explains how to process these requests within the statutory time limits.

Security and data breaches

Appropriate technical and organisational measures are mandatory. The code provides concrete examples of security measures and a step-by-step plan for data breach notification.

Processor agreements

When you outsource data processing to a third party, you need a processor agreement. The code provides a model agreement and explains what should be included.

Retention periods

You may not store data longer than necessary. The code helps you set retention periods and explains how to securely delete data after the period expires.

Dataprocode compliance dashboard met checklist en privacy-instellingen

Who is the Data Pro Code for?

The Data Pro Code is primarily aimed at data processors — organisations that process personal data on behalf of a controller. This includes IT service providers, marketing agencies, HR service providers, cloud providers and hosting companies.

But also as a controller — the organisation that determines the purpose and means of the processing — the code is valuable. It provides a practical framework for entering into processor agreements and monitoring your processors.

In short: any organisation that processes personal data — and that is practically every organisation — can benefit from the Data Pro Code.

What are the benefits of adhering to the Data Pro Code?

Demonstrable compliance

By adhering to the code, you demonstrate to the AP, customers and partners that you take data protection seriously. This is a strong trust signal.

Practical guidance

The AVG is complex and abstract. The Data Pro Code translates the legal requirements into concrete, applicable measures. You immediately know what to do.

Lower risk of fines

The AP takes adherence to recognised codes of conduct into account when assessing violations. The code is a mitigating factor in enforcement.

Competitive advantage

Customers are increasingly asking about data protection. If you can show that you adhere to the Data Pro Code, you distinguish yourself from competitors who do not.

Simpler processor agreements

The code includes a model processor agreement that you can use directly. This saves time and legal costs.

How do you start with the Data Pro Code?

Implementing the Data Pro Code is a step-by-step process. It is not a one-off action, but a continuous process of improvement and monitoring.

Step 1: Map which personal data you process and for what purpose

Step 2: Determine the legal basis for each processing operation

Step 3: Check whether your technical and organisational measures are adequate

Step 4: Review and update your privacy statement

Step 5: Draft or review processor agreements

Step 6: Set up a process for data subject requests

Step 7: Create a data breach notification protocol

Step 8: Train your employees in data protection

Data Pro Code and other standards

The Data Pro Code complements other standards such as ISO 27001, NEN 7510, BIO and the NIS2 directive. Where ISO 27001 focuses on information security in general, the Data Pro Code specifically targets the protection of personal data.

For many organisations, the Data Pro Code is a first step towards a broader compliance programme. The code is less complex and more accessible than a full ISO certification, but still provides demonstrable value.

Need help with the Data Pro Code?

We help you implement the Data Pro Code within your organisation.

From gap analysis to policy drafting and training — we provide practical support for your compliance journey.

Request free advice

What is the Data Pro Code and what is it good for?