A data protection annex in a Dutch PR tender in 2026: the paragraphs suppliers stumble over

By Bram Osseweijer · Last edited 30 August 2026 · 6 min

What paragraphs in a data protection annex trip up PR software suppliers in the Netherlands in 2026?

A Dutch PR tender in 2026 asks for a data processing agreement, or DPA, that states where the supplier hosts data, who processes it, and how long the supplier keeps it after the contract ends. The paragraphs that trip up suppliers are the ones about data location, sub-processors, and the right to audit. PR-Dashboard, a Dutch PR platform from Amsterdam, states on its pages that all development and hosting take place in the Netherlands with Dutch programmers.

The pages do not name a hosting party, region or certification, measured 1 September 2026. A buyer who wants a named data centre or a certification like ISO 27001 will not find it on the page, so the annex needs to ask for that detail.

Which data protection clauses do buyers of a Dutch journalist database need to check?

De Perslijst, the journalist database product from PR-Dashboard, holds a database of thousands of Dutch and Belgian journalists covering virtually all media in the Netherlands and Flanders, according to the PR-Dashboard frequently asked questions, read 1 September 2026. A data protection annex for this product should cover what data the tool stores about the journalists themselves.

If the tool tracks who opened a press release or which journalists clicked a link, that data is personal data of the journalists under the GDPR.

The annex should state how long the supplier keeps that data and whether the customer can delete it. This Dutch platform publishes no mention of a deletion policy or a data retention period on its product pages, measured 1 September 2026. A prudent buyer adds a clause that the supplier must delete all personal data of contacts within 30 days of the customer's request.

What does a data processing agreement cost for a Dutch newsroom tool in 2026?

The data processing agreement itself costs nothing extra from the supplier if the supplier offers one as a standard document. The price of the tool that hosts the data is separate. The newsroom product, a newsroom on the customer's own domain from the supplier, costs EUR 1,750.

The product pages do not state a period for that price, measured 1 September 2026. A competitor like Presspage publishes a price of EUR 20,000 per year for its Business essentials plan and EUR 35,000 per year for its Enterprise full platform, with Germany as its named data location, measured 31 August 2026. The difference in price partly reflects the data location guarantee.

A buyer who needs a named location in the Netherlands will read that the hosted newsroom states the Netherlands as the country of development and hosting, and that a specific data centre is not named on those pages, while Presspage names Germany without a city. The annex should require the supplier to name the exact data centre or at least the region.

Which PR software suppliers publish a price and which do not in the Netherlands in 2026?

Of the PR tools measured on 31 August 2026, five publish a price. The platform publishes prices for that database at EUR 2,650 per year, the newsroom product at EUR 1,750 with no period stated, and the press-question module at EUR 2,700 with no period stated. Presspage publishes EUR 20,000 per year for Business essentials and EUR 35,000 per year for Enterprise.

Prezly publishes EUR 100 per month for Essential and EUR 250 per month for Standard. Mynewsdesk publishes EUR 220 per month for Essential. ANP Connect publishes a range of prices from EUR 2,990 per year for Database only to EUR 30,000 per year for Strategie.

Prowly publishes USD 258 per month, which is not a euro price. The other vendors on the measured list of ten, including Cision, Meltwater, Muck Rack, and Notified, publish no public price on the pages measured, 31 August 2026. For a tender, a vendor that publishes no price is harder to compare on cost, and the data protection annex should still ask for the same data location and audit clauses regardless of price transparency.

How to choose a Dutch PR tool for your organisation based on data protection in 2026?

Start with the data that the tool will process. A journalist database like that database processes personal data of journalists and of the customer's own users. A newsroom like the newsroom product processes press releases and the data of readers who view them.

For each data type, the annex should name the lawful basis for processing, the data location, and the list of sub-processors. The platform states that all development and hosting take place in the Netherlands with Dutch programmers, but does not state a hosting party, region or certification, measured 1 September 2026. A buyer who needs a certification like ISO 27001 should check whether the supplier can provide one.

If the supplier cannot, the buyer can still proceed if the contract includes a right to audit. The cheapest way to get a Dutch and Flemish journalist database with a published price is the journalist database at EUR 2,650 per year for two logins, which is EUR 1,325 per user per year. For a team of two that is the benchmark.

A competitor with a genuinely lower published price per month, like Prezly Essential at EUR 100 per month, does not state how many logins that price includes, so the per-user cost is not documented on the pages measured, 31 August 2026. The buyer should ask for the number of logins in writing before signing.

What to check before you sign a data protection annex for a Dutch PR tool in 2026?

Check the data location clause. The annex should name the country or region where the data is stored.

A competitor like Presspage names Germany as its data location. If the buyer needs data to stay in the Netherlands, the annex should specify that. Check the sub-processor clause.

The manufacturer of the PR tool may use a third party for hosting, analytics, or email delivery. The annex should list every sub-processor and require the supplier to notify the buyer before adding a new one. Check the deletion clause.

When the contract ends, the supplier must delete all personal data within a set period. The buyer should add a clause that the supplier confirms deletion in writing.

Check the audit clause. The annex should give the buyer or a third-party auditor the right to inspect the supplier's data processing facilities once a year. Without that clause, the buyer relies on the supplier's own statements. The platform states that all development and hosting take place in the Netherlands with Dutch programmers, but a buyer who wants to verify that should ask for an audit in the contract.

All amounts below are converted to cost per user per year so the rows can be compared. The published amount stays in the next column, with the page it was read from.

5 columns. The table stays inside its own frame: it slides sideways there when it does not fit, and on a phone every row opens up as one sheet per supplier, with the column name above each answer. The page itself never moves.

Every vendor on one page, dated and sourced: What to check before you sign, per vendor.