The Dutch organisation for the protection of privacy has an
English language website.
From what I understand, if organisations collect data about identifiable persons, they need to register with the Dutch DPA (
CBP in Dutch).
A citizen can ask to see their personal "file".
I also seem to remember something about an obligation to publish a (legally binding) privacy statement, but could not find anything about that. Perhaps that's part of European law.