Module 4 · 4.2
Privacy: what is public and what is not
Module 4: WHOIS, RDAP and privacy · Reading time: 9 minutes
Learning objective: After this lesson you can explain, per extension, which details of a registrant are public under the GDPR and NIS2, and how someone with a legitimate interest can request the hidden details.
Key concepts: GDPR, redaction of personal data, legal person and natural person, WHOIS privacy, proxy service, legitimate requesters, contact via a form
From everything public to redacted
In the past, anyone could read the name, address, phone number and email address of every registrant in the WHOIS. That was handy for anyone who wanted to reach a registrant, but also for spammers and scammers. Since the GDPR (the European privacy law, May 2018), that has changed. Since then, registrants' personal data has largely been redacted.
The main rule is the same at almost every registry:
- Details of a natural person (a human being, such as a private individual) are largely redacted.
- Details of a legal person (a private limited company, foundation, association or other organisation) are not personal data and are, in principle, public.
NIS2 has made that second rule official: registries and registrars must publish data that is not personal data (lesson 3.3). So if you are an organisation, your name simply appears in the public data. That is intentional: anyone visiting a site should be able to see which organisation is behind it.
What you see per extension
The details differ per registry. This is how it looks (as of November 2026):
| Extension | Private individual | Organisation |
|---|---|---|
| .nl (SIDN) | No name; in RDAP "REDACTED FOR PRIVACY" | Name of the organisation |
| .de (DENIC) | Nothing public | Details of the organisation |
| .eu (EURid) | Only email address and preferred language | Name, city, region and country |
| .be (DNS Belgium) | Nothing by default | Name, address and email (no personal name or phone) |
| .com and other gTLDs | May be redacted (required where privacy law demands it); the country is always shown | Depends on the registrar |
A few things stand out:
- With .nl, the Whois does show the email address of the administrative contact. It is there so people can email the registrant. If your personal address is listed there, it is visible. The registrar, the reseller, the technical contact, the status, the nameservers and the dates are public too.
- With .eu, a private individual's email address is visible. Use an address there that you don't mind sharing.
- With .be, a registrant can choose through their registrar to show more.
- With gTLDs, if the registrant's email address is redacted, there must be a forwarding address or a web form so you can still reach the registrant.
WHOIS privacy and proxy services
Many registrars offer WHOIS privacy: a service that hides your contact details in the public WHOIS. For gTLDs there are also proxy services: an intermediary is then listed in the public data instead of you.
Please note:
- With .nl and .eu, the registrant may not be a privacy or proxy service. The domain must be in the name of the real registrant. The registry handles redaction itself there, as in the table above.
- WHOIS privacy is not available for every extension, and for many country extensions it is not needed either, because the registry already redacts the details of private individuals.
- For an organisation, redaction makes little sense: the name of a private limited company is not personal data. If, as an organisation, you don't want to show employees' names, use generic addresses as contacts (lesson 3.3).
Who may see the redacted details?
Redacted is not the same as secret. Anyone with a legitimate interest can request the details. Think of the police and other competent authorities, but also of someone who owns a trademark and wants to act against a name that resembles it. A few examples:
- DENIC only releases details of private individuals to someone who makes a legitimate interest plausible, or to whom DENIC is legally obliged to release them.
- NIS2 requires registries and registrars to answer lawful, substantiated requests quickly, and in any case within 72 hours.
- With gTLDs, contact with a redacted registrant goes through the registrar's forwarding address or web form.
Want to reach a registrant, for example because you want to buy their name or because their site uses your trademark? Then use the contact option shown in the WHOIS or RDAP. If that doesn't work, you can submit a request through the registry or the registrar, with good substantiation. In a trademark dispute, that is the moment to ask a lawyer (lesson 7.2).
What this means for you
Assume that everything you enter for a domain may become visible to someone. All your details are visible to the registry and your registrar, and to legitimate requesters too. That is no reason to enter incorrect details: that is not allowed, and you risk losing your name (lesson 3.3). It is a reason to choose deliberately:
- As an organisation: a generic email address and a generic phone number as contact.
- As a private individual: an email address you are happy to share, especially with .eu and for the admin-c of .nl.
Check regularly what is public about your domain. That way you also see straight away whether the details are still correct.
In practice: how it works at WebOké
In My WebOké, the Advanced card on the domain page has the WHOIS privacy option: "Hides your contact details in the public WHOIS." It is not available for every extension. To see what is public about a domain, use the WHOIS lookup (https://www.weboke.nl/en/toondomein). Other registrars work in a similar way: privacy is usually found in the domain settings, and every registrar has a WHOIS search.
Summary
- Since the GDPR, details of private individuals are redacted; details of organisations are public, and NIS2 makes that official.
- What you see differs per extension: with .eu, for example, a private individual's email address; with .nl, the email address of the admin-c.
- With .nl and .eu, a privacy or proxy service may not be listed as the registrant.
- Anyone with a legitimate interest can request redacted details; NIS2 requires an answer within 72 hours.
Quiz
Exercise
Exercise D4.2: What does it say about you? Look up your own domain (or your organisation's) in the WHOIS lookup (https://www.weboke.nl/en/toondomein). If your extension supports RDAP, also check the registry's RDAP page (lesson 4.1). Write down what anyone can see about you or your organisation, and decide whether that is fine.
Tick off:
- I have looked up my domain in the WHOIS and, where possible, in RDAP.
- I know whether I am registered as a private individual or as an organisation.
- I have checked which names, addresses and email addresses are visible.
- I know whether WHOIS privacy exists for my extension and whether I need it.
Fill in:
- Which details about the registrant and the contacts are public?
- Is there a personal detail listed that you would rather not share? How do you solve that without entering incorrect details?
- Can someone who wants to reach you do so using these details? How?
Exercise D4.2: What does it say about you?
You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.
Describes what is visible for the extension (e.g. .nl: organisation name yes, private individual's name no, but the admin-c email address, registrar, status, nameservers and dates are; .eu private individual: email and language). Solves an unwanted personal detail with a general address or number or (where available and permitted) WHOIS privacy, never with incorrect details; knows that a proxy may not be the holder for .nl and .eu. Names the contact route: the admin-c email address, a forwarding address or web form for gTLDs, or a request with a legitimate interest via the registry/registrar.
Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.