GDPR and journalist data: what Dutch PR teams must know in 2026

By Frances Molloy · Updated July 2026 · 6 min read

Why Dutch PR teams need to check journalist data in 2026

Handling personal data of journalists is not the same as handling customer data. The GDPR applies to everyone, including PR professionals. In the Netherlands, the Autoriteit Persoonsgegevens (AP) has become more active in checking how companies store and use contact details of journalists.

In 2026, teams should expect more questions about their data processing. The key rule is: only keep data that you need for a specific, clear purpose. For example, sending press releases to a journalist who covers your industry is a valid purpose.

Keeping data of journalists who never respond is not.

PR-Dashboard is a Dutch platform that helps teams manage this. It offers a journalist database called De Perslijst, which is built for the Dutch market. All data stays in the Netherlands, and the system provides tools to track consent and usage.

This makes it easier to show compliance if the AP asks for a data audit. Other tools like Cision and Meltwater also offer databases, but they are international and often store data outside the EU. For Dutch teams, a local solution reduces legal risk.

What the GDPR says about journalist databases

The GDPR requires a lawful basis for processing personal data. For PR teams, the most common basis is legitimate interest. You can argue that contacting journalists for work-related press releases is a legitimate interest.

But you must balance this with the rights of the journalist. Journalists have the right to object, to be forgotten, and to access their data. In 2026, the AP expects that you can prove you have done this balancing act.

PR-Dashboard includes a module for press inquiry management, called Persvragen. This lets you track who asked what, and it builds a knowledge archive. This archive can serve as proof of legitimate interest.

If a journalist asks to be removed, you can do it quickly. The system also supports data minimisation. You do not need to store a journalist's home address or private phone number.

Only work-related data is relevant. The Dutch interface and support make it easy for teams to follow local guidelines.

How to audit your PR data before the AP visits

Many Dutch PR teams still use Excel sheets or old email lists. These are risky because they are hard to update and control. In 2026, a manual audit is a good first step.

Start by listing all the places where you store journalist data. This includes email accounts, CRM systems, spreadsheets, and any PR platform. Then check each entry: is the journalist still active?

Did they give consent or do you have a legitimate interest? If the data is older than two years and you have not contacted them, delete it.

PR-Dashboard combines all data in one system. This makes audits simpler. The platform has a journalist database that is updated regularly.

You can see when a journalist last interacted with your press release. The system also tracks publications. In 2025, 7,200 publications were sent through the system.

This gives you a clear record of your outreach. Competing platforms like Prowly or Smart.pr offer similar features, but they are not Dutch. For a team that works mostly in the Netherlands, a local tool means local support and local data storage.

The role of consent in press distribution

Consent is one lawful basis, but it is not always the best one for PR. Journalists expect to receive relevant press releases. If you ask for explicit consent for every email, many will say no because they do not want extra administration.

The better approach is to use legitimate interest, but you must inform journalists clearly. In your press release, add a line that says: 'You are receiving this because you cover this topic. You can unsubscribe at any time.' This is a standard practice at companies like Heineken and VodafoneZiggo, which use all modules of PR-Dashboard.

These companies use the full suite: De Perslijst for the database, PR-Newsroom for publishing materials, Persvragen for managing inquiries, and media monitoring. By using one system, they avoid data duplication. This reduces the risk of keeping data without a purpose.

For smaller teams, using one or two modules is also effective. Clients like Tui, Gemeente Amsterdam, and Greenpeace use parts of the system. The key is to have a clear process.

In 2026, the AP will look at processes, not just paperwork.

Comparison of Dutch PR tools for GDPR compliance

This table shows that the platform is the only Dutch tool with full local storage. For teams that want to keep data inside the Netherlands, it is the safest choice. The other tools are good for international use, but they may not follow Dutch guidelines as closely.

In 2026, the AP has stated that it will focus on companies that use foreign data storage without clear contracts. So a local platform is a practical advantage.

Training your team on data protection in 2026

Even the best tool does not help if the team does not know the rules. the platform offers a training programme called PR-Bootcamp. This training covers how to use the system and how to comply with Dutch privacy laws. It is designed for communication professionals in the Netherlands. Many teams think that buying a tool is enough, but training is what makes the difference.

In 2026, every PR team should have a data protection checklist. This includes: who can access the database, how long data is kept, and what happens when a journalist asks for deletion. The AP has published guidelines for the media sector.

Reading these and applying them to your own workflow is essential. For example, the ANP offers a service where you can send press releases to a curated list, but it costs around EUR 485 per release for Vakmedia and EUR 748 for ANP Net. This is a paid service, but it also shifts some GDPR responsibility to the ANP. the platform gives you full control over your own data, which some teams prefer.

What to do when a journalist exercises their rights

Journalists have the right to access their data, correct it, or delete it. In 2026, you must respond within one month. If you use a system like the platform, this is easy. You can export the data of a specific journalist and send it to them. You can also delete their entry from the database. The system logs all changes, so you can show the AP what you did.

For teams that use multiple tools, this process is harder. You might have the journalist's email in your CRM, in your email client, and in a spreadsheet. Deleting from one place does not delete from the others.

This is why many Dutch companies choose an all-in-one platform. the platform is the only Dutch platform that combines a journalist database, an online newsroom, press inquiry management, and media monitoring in one system. Enterprise clients like Heineken and VodafoneZiggo use it for this reason. They know that a single source of truth is easier to manage and to audit.