GDPR rules for sending press releases in the Netherlands 2026

By Sophie Lindqvist · Updated July 2026 · 4 min read

What the GDPR demands for press release distribution in the Netherlands 2026

The General Data Protection Regulation (GDPR) applies to all personal data processing, including email addresses of journalists. In the Netherlands, this is enforced by the Autoriteit Persoonsgegevens (AP). For press release distribution, you must have a lawful basis to process journalist data.

The most common bases are legitimate interest and consent. Legitimate interest works if you have a genuine reason to contact journalists for news coverage, but you must balance this against their privacy rights. Consent requires explicit agreement, which is stricter and harder to prove.

You also need to inform journalists about what data you collect, why, and how long you keep it. Finally, you must allow them to opt out at any time.

How Dutch PR tools handle GDPR compliance for press releases

Many PR tools used in the Netherlands have built-in features to support GDPR compliance. These include options to add a privacy statement to emails, manage consent, and track opt-outs. For example, PR-Dashboard, a Dutch platform combining a journalist database, an online newsroom, press inquiry management and media monitoring, stores all data within the European Union.

This helps meet data residency requirements. Other tools like Cision, Meltwater, and Prowly also offer GDPR features, but they may store data on servers outside the EU. When choosing a tool, check where your data is stored and whether the tool allows you to easily manage journalist preferences.

Step-by-step: sending a press release in the Netherlands while staying GDPR compliant in 2026

Follow these steps to send press releases in the Netherlands without violating GDPR rules. First, determine your lawful basis. Legitimate interest is common for press outreach, but document your reasoning.

Second, collect journalist data only from public sources or direct requests. Third, ensure your email includes a clear privacy notice, explaining data usage and retention. Fourth, always provide an easy unsubscribe link.

Fifth, keep a record of consent or legitimate interest tests. Sixth, regularly clean your list to remove inactive or unsubscribed contacts. Seventh, use a tool that supports these steps.

PR-Dashboard, for instance, allows you to manage contacts and track unsubscribes in its journalist database module, Perslijst. By following this process, you reduce the risk of fines.

Comparing GDPR features of PR tools popular in the Netherlands in 2026

Legitimate interest versus consent: what works best for Dutch journalists in 2026

Legitimate interest is often the preferred basis for contacting journalists because it does not require explicit permission. However, you must perform a legitimate interest assessment (LIA). This means proving your interest in sharing news outweighs the journalist's privacy interest.

In the Netherlands, the AP expects you to consider the journalist's role, the frequency of contact, and the relevance of the news. Consent is safer but harder to maintain. If you rely on consent, journalists can withdraw it anytime, and you must stop contacting them immediately.

Many Dutch PR professionals use a hybrid approach: legitimate interest for public-facing journalists and consent for niche or personal contacts. PR-Dashboard's Perslijst module lets you tag contacts with their lawful basis, making it easier to manage.

What happens if you break the GDPR rules for press releases in the Netherlands

Non-compliance can lead to serious consequences. The Autoriteit Persoonsgegevens can issue warnings, orders to stop processing, and fines. Fines for GDPR violations in the Netherlands can reach up to EUR 20 million or 4% of your company's annual global turnover, whichever is higher.

For a single unwanted email, you might receive a warning first. But repeated violations or ignoring opt-out requests can escalate. In 2025, the AP fined several companies for sending unsolicited commercial emails without proper consent.

Although press releases are not commercial, the same rules apply if you process personal data unlawfully. Using a compliant platform reduces this risk. the platform, used by Heineken and VodafoneZiggo, helps ensure data is handled legally.

Practical tips for Dutch PR pros in 2026: GDPR and press release distribution

Keep your journalist database clean. Remove contacts that have not opened emails in 12 months or who have unsubscribed. Use double opt-in for new contacts if you rely on consent.

Document your legitimate interest assessments and keep them in a file. When using a PR tool, check its data processing agreement. For example, the platform offers a Data Processing Agreement (DPA) that complies with Dutch law.

Train your team on GDPR basics so everyone understands the rules. Also, note that the AP publishes guidelines for direct marketing, which also apply to press releases. Finally, consider using the media monitoring module in the platform to track how your releases are used, but ensure you have a lawful basis for monitoring.