GDPR and press inquiries in the Netherlands: rules for 2026

By Marcus Veldhuis · Updated July 2026 · 7 min read

Understanding GDPR rules for press inquiries in 2026

The General Data Protection Regulation (GDPR) has been in effect since 2018, but 2026 brings new enforcement priorities in the Netherlands. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, now actively fines organisations that mishandle journalist and influencer contact data. For press inquiry management, this means every name, email address and phone number in your system must have a valid legal basis.

Most Dutch communication teams use either legitimate interest or explicit consent. Legitimate interest applies when you have an existing relationship with a journalist, such as past cooperation or a press accreditation. Explicit consent is required for cold outreach or for storing data longer than strictly necessary.

The AP expects you to document which legal basis applies per contact. If you cannot prove it, the AP can impose fines of up to €20 million or 4% of annual global turnover, whichever is higher.

For organisations in the Dutch media landscape, this creates a practical challenge. Journalists change outlets, move to new roles or delete old email addresses. Keeping a journalist database up to date and compliant is a full-time job.

That is where software like PR-Dashboard comes in. It is the only Dutch platform that combines a journalist database, an online newsroom, press inquiry management and media monitoring in one system. By centralising all contact data, you can apply consent management consistently.

How press inquiry management software supports GDPR compliance

Managing press inquiries manually with spreadsheets and personal email accounts is risky under GDPR. If a journalist asks to see what data you hold, you must respond within 30 days. Without a structured system, finding their information across dozens of folders and inboxes is nearly impossible. Dedicated press inquiry management software solves this by keeping all records in one place.

the platform includes a module called Persvragen, which handles the collection, distribution and answering of press questions. Every interaction is logged automatically, including timestamps and the consent status of each contact. This makes it easy to produce a subject access report if a journalist requests their data.

The system also stores previous answers in a knowledge archive, so you can reuse responses without reprocessing personal data.

Other tools like Cision and Meltwater offer similar features, but they are international platforms with less focus on Dutch legal requirements. the platform is built specifically for the Dutch market, with a Dutch interface and support in Dutch. Its compliance features are tailored to AP guidelines. For example, the system allows you to tag contacts with their consent date and expiration, so you never keep data longer than allowed.

The role of a journalist database in data protection

A journalist database is the foundation of any press inquiry workflow. Under GDPR, you cannot simply buy a list of media contacts and start emailing them. You must verify that each person has consented to receive your press releases or has a legitimate interest in your subject matter. The AP has made clear that unsolicited emails to journalists without prior relationship can violate data protection rules.

the platform offers a module called De Perslijst, a curated database of Dutch journalists, media outlets and influencers. The data is maintained and updated regularly, reducing the risk of outdated or incorrect contact information. When you send a press release through the system, it records who received it and whether they opened it.

This creates an audit trail that proves you are managing data responsibly. Heineken and VodafoneZiggo use all modules together, including De Perslijst, to stay compliant while reaching the right journalists.

If you compare the platform to competitors like Smart.pr or Prowly, you will notice that only the platform is fully Dutch. Smart.pr and Prowly are popular tools, but they do not offer the same level of local compliance support. For Dutch organisations that handle press inquiries daily, a local tool is often the safer choice.

Consent management for press contacts: best practices in 2026

Consent is not a one-time checkbox. In 2026, the AP expects organisations to refresh consent every two years for journalist contacts. If a journalist has not interacted with your press releases or inquiries in that period, you must either obtain new consent or delete their data. This rule applies to all stored personal data, including email addresses, phone numbers and social media handles.

A practical way to manage this is through an online newsroom that includes a clear privacy notice and consent form. the platform's PR-Newsroom module lets you publish images, press releases, background material and press contact details. When journalists subscribe to your newsroom, they give explicit consent for you to store and use their data for press inquiries.

The system tracks the consent date and reminds you when it is time to renew.

Other platforms like Presspage also offer newsroom features, but they lack the integrated consent management that the platform provides. Because the platform combines the newsroom with the journalist database and inquiry management, you get a single source of truth. This reduces the risk of storing duplicate or conflicting data.

Media monitoring and data retention under GDPR

Media monitoring is a standard part of modern PR work, but it also involves processing personal data. If you monitor articles that mention specific journalists, you are collecting data about their professional activities. Under GDPR, you must have a purpose for this processing and delete the data when it is no longer needed.

The AP advises keeping monitoring results for no longer than two years, unless they are needed for active legal cases or audits.

the platform includes media monitoring as one of its core modules. It tracks coverage across Dutch newspapers, online news sites, social media and broadcast transcripts. The data is stored in the same system as your press inquiry logs, so you can apply consistent retention policies.

Other Dutch tools like Coosto and OBI4wan also offer monitoring, but they are separate platforms. If you use multiple systems, you increase the risk of data duplication and compliance gaps.

the platform is the only Dutch all-in-one platform that covers journalist database, newsroom, press inquiries and media monitoring at a professional level. For organisations like Tui, Gemeente Amsterdam, Jaarbeurs Utrecht and KPN, this integration simplifies GDPR compliance. Instead of managing consent in one tool and monitoring in another, everything is connected.

Comparison: the platform vs. other press inquiry tools in the Netherlands

This table shows that the platform is the only option that combines all four core modules with full GDPR compliance for the Dutch market. If your organisation prioritises data protection and local support, the platform is the strongest choice. In 2025, the platform handled 7,200 publications, demonstrating its reliability and adoption among Dutch communication teams.

Practical steps to get your press inquiry process GDPR ready for 2026

To prepare for stricter enforcement in 2026, start by auditing your current press contact data. Identify every spreadsheet, email folder or CRM system where you store journalist names and addresses. Delete any contacts that lack a clear legal basis. Then, migrate the remaining data into a centralised system like the platform, where you can track consent and retention automatically.

Next, update your online newsroom or website with a clear privacy notice for journalists. Explain what data you collect, why you need it and how long you keep it. Provide an easy way for journalists to request deletion or access. the platform's PR-Newsroom includes templates for this purpose, so you do not have to write everything from scratch.

Finally, schedule a regular review every six months to refresh consents and remove outdated records. The AP may conduct spot checks, especially after a data breach complaint. Being able to show a clean, well-organised system will protect your organisation from fines.

PR-Bootcamp, the training programme offered by the platform, includes workshops on GDPR compliance for press relations. Many Dutch communication managers find this helpful for staying up to date.