GDPR Fines Going Public: What It Means for Freelancers and SMEs
Not legal advice — consult a qualified legal or privacy specialist for your specific situation.
From 1 September 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) states that it is legally required to publish every GDPR fine it imposes, including the full reasoning behind each decision. Where publication was previously at the AP's discretion, it is now mandatory. If you build or use software that processes personal data, from a simple CRM to an HR application, this directly affects you.
What Changes: GDPR Fines Made Mandatory Public
The AP will no longer just announce that a sanction has been imposed. It will also publish how it reached that decision, including the methodology and full motivation. That is a significant shift: previously, a fine could remain quiet if the AP chose not to publicise it. Transparency is now the default.
For you as a business owner, this means two things:
- Your name could appear. Any sanction imposed on your business will be publicly visible to clients, partners and competitors.
- You can learn from others' mistakes. Published motivations reveal which practices the AP actually enforces. That is valuable intelligence.
The AP confirmed this on its website: AP maakt AVG-sancties voortaan verplicht openbaar.
Note: The exact scope of the legislative change, any publication thresholds, and whether sanctions issued before 1 September 2026 will also be published have not yet been confirmed in public documentation. Consult the official AP documentation for the current legal text.
Who Is at Risk?
Say you are a freelance developer building a scheduling or time-tracking tool for small employers. That tool stores names, working hours and possibly location data. Depending on your contractual arrangements, you are either a processor or a controller under the GDPR (Article 4(7) and (8)). You fall fully within the AP's enforcement powers.
The same applies to:
| Software type | Personal data processed | Risk if inadequately secured |
|---|---|---|
| CRM tool | Customer data, contact history | High |
| HR application | Salary data, employment contracts | High |
| Time tracking | Working hours, location, project names | Medium |
| Invoicing software | Name/address data, payment history | Medium |
| Scheduling tools | Rosters, personal profiles | Medium |
For background on how time tracking and privacy rules intersect, see our knowledge base article GDPR & Time Tracking: Legal Basis, Location Data.
What Mandatory Publication Means in Practice
Reputational risk increases. A fine that might previously have gone unnoticed is now publicly searchable. Clients, commissioners and investors can find it. For a freelancer or small business, this can have a direct impact on revenue.
Published motivations act as a compliance compass. Because the AP publishes its reasoning, you gain insight into exactly which practices are being penalised. Read published decisions and test your own processes against them.
Data processing agreements become critical. If you supply software to other businesses, you are a processor. According to the GDPR, a proper data processing agreement is required. Not yet in place? The GDPR Templates for SMEs 2026 can help you get compliant quickly.
Automated decision-making is under the spotlight. The AP has previously issued fines for unlawful automated decision-making. The Uber case is a well-known example. With motivations now published, this is an area requiring extra vigilance. Read more in GDPR Automated Decisions: Uber's Fine Explained.
Three Steps You Can Take Today
You do not need to achieve perfect GDPR compliance overnight, but delay increases risk.
1. Map your data flows. Which personal data does your software or organisation process? Document this in a record of processing activities. The AP describes the requirements at autoriteitpersoonsgegevens.nl.
2. Put data processing agreements in place. Any third-party software you use for time tracking, CRM or invoicing requires a data processing agreement according to the AP. Check whether you have one and whether it is up to date.
3. Monitor published AP decisions. Mandatory publication of motivations is an opportunity: treat it as free compliance intelligence. Set up a search alert on the AP website for your sector or software category.
For practical guidance on protecting customer data, see CRM Data Security: What Supply Chain Risks Teach You.
Conclusion
The mandatory publication of GDPR sanctions is not an administrative formality. It is a structural change in how enforcement becomes visible. For freelancers and SMEs who build or use software processing personal data, reputational risk is now higher. At the same time, published motivations offer genuine insight into what the AP actually enforces. Businesses with their privacy policy in order have nothing to fear and can use public transparency as a competitive advantage.
Frequently Asked Questions
Does mandatory publication apply to small fines too? Available sources do not mention publication thresholds. Whether a minimum amount applies has not been confirmed. Check the current Autoriteit Persoonsgegevens documentation for the latest position.
I only use an external accounting package. Does GDPR still apply to me? Yes. According to the GDPR, even if you use a third-party tool that processes your clients' personal data, you remain the controller. The AP states that you are required to have a data processing agreement with that software provider.
Will sanctions issued before 1 September 2026 also be published? This has not been confirmed in available sources. The measure clearly applies to sanctions after 1 September 2026. Whether earlier decisions will be published retroactively is unclear. Monitor the AP website for updates.
What is the difference between a processor and a controller? A controller determines the purpose and means of processing personal data, typically your client or yourself as a business owner. A processor handles data on behalf of the controller, typically the software provider. Both roles carry distinct obligations under the GDPR.
Get your administration in order today
PrikKlokPlus helps freelancers and SMEs keep hours, projects, client data and invoicing organised in one platform.