Businesses are likely to have to wait years to find out the extent to which they are at risk of data protection or privacy-related mass actions in the Netherlands, an expert has said.