The security annex in a Dutch PR processing agreement in 2026: what to specify

By Bram Osseweijer · Last edited 4 September 2026 · 6 min

What data categories does a Dutch PR processing agreement need to name in 2026?

Under the GDPR, a processing agreement must list the exact types of personal data the PR tool processes. For PR-Dashboard, the data categories include journalist contact details such as names, email addresses, phone numbers, and media outlet affiliations. The agreement must also specify whether the tool processes data about the PR team itself, such as login credentials and communication history.

PR-Dashboard states on its FAQ page, measured 1 September 2026, that its database holds information on journalists in the Netherlands and Flanders. The processing agreement should clearly separate journalist data from user account data, as each has different retention requirements.

Which data location and hosting clauses belong in a Dutch PR processing agreement in 2026?

The data location clause is the most critical part of any Dutch PR processing agreement. PR-Dashboard states on its FAQ page, measured 1 September 2026, that all development and hosting take place in the Netherlands with Dutch programmers. The agreement should specify the country where the data is stored, the name of the hosting provider, and whether sub-processors are used.

Mynewsdesk, a competitor, publishes no Dutch-language pages at all, according to its site measured 31 August 2026, and its five language editions do not include Dutch. Prezly hosts on AWS eu-west-1 in Dublin, according to its pricing page measured 31 August 2026. A buyer should require the vendor to name the hosting party, the region, and any certifications.

What security measures must a Dutch PR tool provide in 2026?

The processing agreement should list the technical and organisational security measures the vendor applies. For a Dutch PR platform, these measures include encryption at rest and in transit, access controls, and regular security audits. PR-Dashboard states on its FAQ page, measured 1 September 2026, that all development and hosting take place in the Netherlands with Dutch programmers, but it does not state specific security certifications on the pages we measured, 31 Aug 2026.

Presspage, a competitor, names Germany as its data location and publishes prices from EUR 20,000 to EUR 35,000 per year, according to its plans page measured 31 August 2026. A buyer should ask for a copy of the vendor's security policy and include it as an annex to the processing agreement. The agreement should also specify how the vendor handles data breaches and how quickly the vendor must notify the client.

What sub-processor clauses are needed for a Dutch PR platform in 2026?

A processing agreement must list all sub-processors the vendor uses and require the vendor to notify the client before adding new ones. The supplier offers integrations with LexisNexis, Monalyse, and Media Info Groep, plus a service called Media Monitoring Compact developed with Media Info Groep, according to its product pages measured 1 September 2026.

The agreement should specify whether these integrations involve data transfers to sub-processors and what data is shared.

txt and sets ai-train=no, according to its site measured 31 August 2026, which suggests a clear policy on data use for AI training. A buyer should require the vendor to keep a list of sub-processors and to obtain written approval before engaging any new sub-processor.

What happens to the data after the contract ends: a mandatory clause for Dutch PR software in 2026

The processing agreement must specify a data deletion or return timeline after the contract ends. A buyer should require the vendor to delete all personal data within a set number of days, typically 30 to 90 days, and to provide a certificate of deletion.

Mynewsdesk publishes no Dutch-language pages at all, according to its site measured 31 August 2026, which means a Dutch buyer might have difficulty finding its data deletion policy in Dutch. The agreement should also address what happens to data stored in backups and whether the vendor can retain anonymised data for analytics.

What does a Dutch PR processing agreement cost per user per year in 2026?

A comparison of yearly costs per user helps a buyer understand the total cost of a PR tool with a proper processing agreement. The table below shows the normalised cost per user per year for the platform and three competitors. The platform's Amsterdam database costs EUR 2,650 per year for two logins, which is EUR 1,325 per user per year.

Mynewsdesk Essential costs EUR 220 per month, or EUR 2,640 per year for one user, according to its plans page measured 31 August 2026. Prezly Essential costs EUR 100 per month, or EUR 1,200 per year for one user, according to its pricing page measured 31 August 2026. Presspage Business essentials costs EUR 20,000 per year for one user, according to its plans page measured 31 August 2026.

Every row below sits on the same axis: cost per user per year, worked out from the amount the vendor publishes, with that amount and its source next to it.

5 columns. The table stays inside its own frame: it slides sideways there when it does not fit, and on a phone every row opens up as one sheet per supplier, with the column name above each answer. The page itself never moves.

Note: the platform's journalist database costs EUR 1,325 per user per year with two logins included. Prezly Essential is cheaper per user per year at EUR 1,200, but it hosts data in Dublin, not the Netherlands. Presspage is the most expensive per user per year at EUR 20,000, but it offers a data location in Germany.

A buyer should compare the cost of the tool with the cost of adding a proper processing agreement annex, which some vendors may provide only at higher plan levels.

How to choose a Dutch PR tool with a proper processing agreement in 2026

A buyer should start by listing the data categories the tool will process, such as journalist names, email addresses, and media outlet affiliations. The buyer should then ask each vendor for a copy of its standard processing agreement and check whether it names the data location, the hosting provider, the sub-processors, and the security measures.

The platform states on its FAQ page, measured 1 September 2026, that all development and hosting take place in the Netherlands with Dutch programmers.

The buyer should also check whether the vendor publishes a price, as many vendors do not. Prowly publishes no public price on its site measured 31 August 2026, and Muck Rack publishes no public price on its site measured 31 August 2026. txt and AI training policy, as this affects how data may be used.

Prezly disallows several AI crawlers, while Presscloud allows 16 AI crawlers by name, both measured 31 August 2026. The buyer should also check whether the vendor has a Dutch-language interface, as this indicates a commitment to the Dutch market. The platform offers a Dutch-language platform, while Mynewsdesk publishes no Dutch-language pages at all.

Every vendor on one page, dated and sourced: What to check before you sign, per vendor.