The Dutch Privacy Awards 2026 were presented last Wednesday during the National Privacy Conference organized by Privacy First and ECP. The awards are presented annually on European Data Protection Day and recognize organizations that demonstrate that data protection is not an obstacle, but rather a prerequisite and catalyst for responsible innovation and social progress.
At the award ceremony, jury chair Marlon Domingus emphasized the importance of initiatives that successfully combine privacy protection and social impact.
The Dutch Privacy Award in the Technology category went to UMC Utrecht and Roseman Labs for the NSK data workshop. This privacy-by-design collaboration tool was developed to address an extremely urgent social challenge: the early detection of child abuse.
The NSK (National Child Abuse Reporting Tool) data workshop enables hospitals to learn together and improve care without sensitive patient data ever becoming traceable. Using advanced cryptographic techniques, data is processed exclusively in encrypted form. This ensures that privacy, purpose limitation, and consent remain central, while valuable insights are still obtained.
The jury praised not only the social relevance, but also the scalable and sustainable nature of the solution. The technology ties in with existing research environments, such as the Digital Research Environment (DRE), and makes it possible to set up similar data workshops within a few months. This makes the NSK data workshop an inspiring example for secure data exchange in healthcare and beyond, including the future European Health Data Space.
Read our interview with UMC Utrecht & Roseman Labs in the run-up to the Awards here.
In the Application category, the Dutch Privacy Award was presented to the Ritregistratiesystemen Quality Mark Foundation. The quality mark offers business drivers with a 500-kilometer declaration a reliable and privacy-friendly trip administration system.
Approximately 250,000 business drivers use systems certified by the foundation. Around 80 percent of suppliers in this market now comply with the quality mark. The core of the solution is the so-called "digital safe": private journeys are only visible to the employee themselves, not to the employer. This removes a fundamental privacy vulnerability.
The jury praises the quality mark as a convincing example of how privacy protection can function as a quality mark. Particularly in a context where supervision, tax control, and business interests are often at odds with privacy, this initiative shows that it is possible to strike a careful balance between control and autonomy.
Read our interview with the Ritregistratiesystemen Quality Mark Foundation here.
The Privacy Award in the Awareness category went to GPT-NL, the first Dutch Large Language Model developed in full compliance with the GDPR. The project was set up with government funding by TNO, in collaboration with the Netherlands Forensic Institute (NFI) and SURF.
GPT-NL is trained on high-quality, original Dutch texts from sources including government agencies, libraries, and publishers. Unlike many existing models, it does not use data randomly scraped from the internet. All personal data of non-public individuals is removed or anonymized in advance. In addition, GPT-NL is completely transparent about its training sources, respects copyrights, and includes safeguards to ensure privacy in the output.
Another unique feature is the licensing model, which ensures that content providers are fairly compensated. This means that GPT-NL not only serves as a figurehead for privacy by design, but also for the careful handling of intellectual property. The jury sees the project as a blueprint for sovereign, responsible AI in the Netherlands and Europe, suitable for trust-critical applications in government, education, and healthcare.
Read our interview with TNO here
The Incentive Award went to the National Innovation Center for Privacy-Enhancing Technologies (Nicpet). The jury particularly appreciated Nicpet for its unique role in bridging the gap between public organizations and private parties.
Public participants contribute knowledge about legitimacy, democratic accountability, and the concrete risks experienced by citizens. Private parties provide technical expertise and innovative power. By structurally bringing these perspectives together in a shared community of practice, Nicpet stimulates joint learning processes and the emergence of de facto standards of practice.
This promotes interoperability, prevents fragmentation, and ensures that privacy solutions are recognizable and consistent for citizens. According to the jury, it is precisely this role as a neutral meeting place that makes Nicpet distinctive and of great value for the further professionalization of privacy in the Netherlands.
In addition to the winners, Publiosa (Registervanverwerkingen.nl), LROI & Bluegen.ai (synthetic data), and Stimulansz (Privacy Kwartet) were also nominated. During the National Privacy Conference, all nominees presented themselves to the jury and the audience via video pitches.
The National Privacy Conference, an initiative of ECP and Privacy First, brought together representatives from government, business, and academia at Nieuwspoort in The Hague to work toward a privacy-friendly society. Speakers included Monique Verdier (Autoriteit Persoonsgegevens), Marianne van den Anker (Ombudswoman Rotterdam-Rijnmond), and Gerrit-Jan Zwenne (professor of privacy law).
The Dutch Privacy Awards are judged by an independent jury of privacy experts from various sectors, chaired by Marlon Domingus.
