Published on · Last updated
ICT law (IT law) in the Netherlands is not a separate code. It is the set of rules that apply to software, data, cloud and online services: Dutch contract law in the Dutch Civil Code, copyright law on computer programs (Article 10(1)(12°) Copyright Act), privacy and cybersecurity rules, and criminal law, such as computer trespass (Article 138ab Dutch Criminal Code).
Societal dependence on digital systems has made ICT law an essential legal domain. Organizations in the Netherlands confront daily legal complexity regarding software contracts, data breaches, cybersecurity and intellectual property. The field continuously evolves through innovations such as artificial intelligence, Internet of Things and blockchain technology.
A dispute over a failed software project falls under contract law according to the Dutch Civil Code. Furthermore, copyright law applies when websites are illegally copied. Moreover, criminal law addresses computer trespass under Article 138ab Dutch Criminal Code.
What exactly is ICT law in the Netherlands?
ICT law does not constitute an independent legal code but builds into existing legal domains into the digital context. Legal professionals handle technology contracts, data protection, intellectual property rights and cybercrime within this specialized field under Dutch law.
Legal practitioners use various terms for this domain: information law, technology law, cyberlaw or internet law. These designations refer to the same concept: the legal framework for digital technology and communication. The complexity of ICT issues requires specialized knowledge combining technical understanding with legal expertise.
An ICT lawyer in the Netherlands understands technical aspects such as API connections, cloud architecture and software development, and the legal risks around contracts, liability and intellectual property. Typical disputes concern failed ERP or software implementations, data breaches and the copying of software or websites.
Why does ICT law exist as a separate legal field under Dutch law?
Technological developments surpass the pace of legislation, creating legal gaps that traditional law cannot adequately address. ICT law connects technical reality with legal frameworks to resolve complex digital disputes and establish clear rights and obligations.
Consider fragmented data storage in cloud computing distributed across multiple continents. Furthermore, automated decision-making by algorithms raises questions about transparency and accountability. Moreover, the Internet of Things creates liability issues for products with embedded firmware.
Dutch courts develop standards for digital issues through case law on software failures, security breaches and intellectual property disputes. A rule that applies between the parties under an ICT contract does not apply to the extent that this would be unacceptable in the circumstances according to standards of reasonableness and fairness (Article 6:248(2) Dutch Civil Code, DCC).
Which subjects fall under ICT law in the Netherlands?
Software law and intellectual property under Dutch law
Software receives copyright protection as a computer program under Article 10(1)(12°) Copyright Act (Auteurswet). European Directive 2009/24/EC forms the framework for this protection, granting creators exclusive rights to reproduction, distribution and modification of their code.
The legal qualification of software regularly raises questions about ownership, licences and transfer of rights. The maker is in principle the copyright holder (Article 1 Copyright Act). For software that an employee writes as part of the job, the employer is regarded as the maker, unless agreed otherwise (Article 7); the same applies to a person under whose design, direction and supervision the work was made (Article 6). A freelancer or external developer is therefore in principle the maker and keeps the copyright unless it transfers it; the client is regarded as the maker if the software was made after its design and under its direction and supervision (Article 6). A transfer, and an exclusive licence, must be agreed in writing, and the transfer itself requires a deed (Article 2(3)). Without such arrangements, what the client may do with the code depends on what follows from the agreement. Unless otherwise agreed, the lawful acquirer of a copy may make the reproductions needed for its intended use; reproductions made in the course of loading, displaying or correcting errors cannot be prohibited by contract (Article 45j).
Open source software uses specific license conditions such as GPL, Apache or MIT. These licenses contain obligations for source code publication and distribution. Violation of open source licences can lead to infringement claims. Dutch organizations using open source components must comply with attribution requirements and copyleft provisions.
How do ICT contracts work in practice under Dutch law?
ICT contracts under Dutch law regulate delivery of software, hardware or services between parties through detailed specifications, service levels and liability arrangements. Development contracts contain agreements on specifications, delivery and maintenance under Dutch contract law principles.
A hosting agreement determines availability, backups and security measures. Moreover, an escrow agreement regulates access to source code upon supplier bankruptcy. General terms and conditions play a crucial role in ICT contracts. Suppliers often apply FENIT conditions or Netherlands ICT Conditions with extensive liability limitations. Clients use ARBIT conditions or GIBIT conditions with stricter quality and performance requirements.
Service Level Agreements under Dutch law (SLAs) define measurable performance indicators for availability, response time and recovery. An SLA may, for example, specify 99.5% availability per month. The consequences of missing that level, such as service credits or a penalty, are a matter of negotiation.
Example (fictitious): a company buys cloud software with an SLA of 99.9% availability. Over three months, outages total eight hours. The company claims €15,000 for lost revenue; the supplier relies on a contractual penalty of €500 per incident. A clause that obliges the defaulting party to pay a sum of money is a penalty clause (Article 6:91 DCC). In principle, what is due under it replaces statutory damages (Article 6:92(2) DCC). The court can award additional damages on top of such a penalty only if fairness clearly so requires, and it can reduce a penalty on the same test, but not below the statutory damages (Article 6:94(1)-(2) DCC).
What are the risks of cloud computing in the Netherlands?
Cloud computing changes IT infrastructure through external storage and processing of data, creating legal risks including vendor lock-in, data loss, jurisdiction conflicts and regulatory compliance challenges under Dutch and European law.
Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) offer flexibility and scalability. However, legal risks arise from vendor dependency, data loss and geopolitical tensions.
Cloud services often process personal data outside the European Union according to Article 44 General Data Protection Regulation (GDPR). The GDPR prohibits transfers to countries without adequate protection levels. The EU-US Data Privacy Framework replaced Privacy Shield, yet legal uncertainty persists following the Schrems II judgment. Standard contractual clauses and adequacy decisions provide transfer mechanisms with additional safeguards.
Continuity forms an attention point in cloud contracts. Exit provisions secure migration to another supplier without data loss. Cloud escrow arrangements aim to secure access to systems and data if the supplier goes bankrupt. Dutch organizations negotiate retention periods, data format specifications and transition assistance in termination clauses.
Which privacy obligations apply to ICT in Dutch law?
The GDPR regulates protection of personal data during processing by digital systems, requiring appropriate technical and organizational measures according to Article 32 GDPR. Processing agreements impose obligations on parties processing personal data on behalf of controllers.
Processors implement encryption, access controls, logging and incident response procedures. Controllers conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities. Data breach notification duty requires organizations to report violations within 72 hours to the Dutch Data Protection Authority. Furthermore, organizations inform data subjects directly regarding serious privacy breaches under Article 34 GDPR.
Fines for GDPR violations amount to maximum €20 million or 4% of worldwide annual turnover. Organizations document compliance through privacy policies, processing registers and audit reports.
The ePrivacy Directive regulates protection during electronic communication. In the Netherlands, storing or reading information on a user’s device, such as through cookies, requires clear and complete information and the user’s consent (Article 11.7a(1) Telecommunications Act). No consent is needed for cookies used only to carry out the communication, or that are strictly necessary for the service the user requested, or that measure the quality or effectiveness of the service with little or no impact on privacy (Article 11.7a(3)). Tracking and marketing cookies therefore require consent.
How does Dutch law protect against cybercrime?
The Computer Crime Act I, II and III strengthens criminal prosecution of digital crimes, establishing specific offenses for hacking, malware distribution and identity theft. Computer trespass (computervredebreuk) is intentionally and unlawfully intruding into an automated work, for example by breaking a security measure or using a false key (Article 138ab(1) Dutch Criminal Code).
The maximum penalty is two years’ imprisonment or a fourth-category fine. It rises to four years’ imprisonment or a fourth-category fine if the intruder then takes over, taps or records data stored, processed or transferred by means of the system (Article 138ab(2)), or if the intrusion was committed through a public telecommunications network and the intruder then uses the system’s processing capacity to gain an unlawful advantage, or uses the system to gain access to a third party’s system (Article 138ab(3)). Law enforcement officers possess digital investigation powers for intercepting communications and making illegal content inaccessible. Ethical hackers performing penetration tests may face legal risks without explicit consent from system owners.
Identity fraud, piracy and malware distribution are also criminal offences. Intentionally and unlawfully making available or distributing data intended to cause damage in an automated work carries up to four years’ imprisonment or a fifth-category fine (Article 350a(3) Dutch Criminal Code). A Distributed Denial of Service (DDoS) attack carries up to two years or a fourth-category fine, three years if committed with a botnet or for gain, and five years if it causes serious damage or targets vital infrastructure (Article 138b). Ransomware can qualify as extortion: forcing someone, with the aim of an unlawful gain, to hand over money or data by threatening that data stored in an automated work will be made unusable or inaccessible or will be erased carries up to nine years’ imprisonment or a fifth-category fine (Article 317(2)).
What regulates internet law within ICT law in the Netherlands?
Internet law covers legal issues arising from online activities including e-commerce, social media and search engines. Domain name law regulates registration, transfer and disputes over domain names under Dutch jurisdiction and international frameworks.
Domain grabbing and cybersquatting constitute unlawful conduct when domain names infringe trademark rights or trade name rights. Hyperlinks to infringing content may trigger liability according to case law from the Court of Justice. Web scraping without permission can infringe copyright, or the database right if the whole or a substantial part of a protected database is extracted or re-used, or if insubstantial parts are repeatedly and systematically extracted or re-used in a way that conflicts with the normal exploitation of the database or unreasonably prejudices the legitimate interests of its producer (Article 2 Database Act). Naming and shaming on complaint sites balances freedom of expression with reputation protection.
Notice and Take Down procedures used to be linked to Article 6:196c DCC, which limited the liability of intermediaries such as hosting providers. That article was repealed with effect from 4 February 2025; the liability of hosting providers for user content now follows mainly from EU rules that apply directly in the Netherlands. In practice, a provider that acts promptly on a well-founded notice limits its risk.
SIDN manages .nl domain names on a first come, first served basis. Disputes over .nl domain names can be submitted to SIDN’s dispute resolution procedure. International domains (.com, .org, .net) follow the Uniform Domain Name Dispute Resolution Policy (UDRP) adopted by ICANN.
What obligations does an ICT supplier have under Dutch law?
An ICT supplier is usually the expert party and owes its client a duty of care. If the contract is a contract for services, the supplier must observe the care of a good contractor (Article 7:401 DCC). If it is a contract for work, the contractor must warn the client of errors in the assignment that it knew or ought reasonably to have known (Article 7:754(1) DCC). The contract and the circumstances determine how far the duty to warn and advise goes.
Violation of the duty of care can lead to liability for defective implementations. Project management requires active involvement of the supplier in specification, planning and risk management. The supplier warns timely about delays, budget overruns and technical limitations. A passive attitude can amount to a failure in performance, which may justify damages (Article 6:74 DCC) and termination (Article 6:265 DCC).
A limitation of liability in general terms and conditions can be annulled if it is unreasonably onerous for the other party (Article 6:233(a) DCC). That protection does not apply to a legal entity that has published its annual accounts, to a party with fifty or more employees, or to a party that itself repeatedly uses the same or similar terms (Article 6:235(1) and (3) DCC), nor to business contracts between parties that are not both established in the Netherlands (Article 6:247(2) DCC). An exclusion of liability is not automatically void, also for intent or gross negligence; but if Dutch law applies, a party cannot rely on it to the extent that this would be unacceptable according to standards of reasonableness and fairness (Article 6:248(2) DCC). Limitations to the contract value or the insured amount are common in practice.
What are public procurement procedures for ICT projects in the Netherlands?
Government authorities procure ICT projects according to the Public Procurement Act 2012 and European directives. Threshold amounts determine the procedure: above the European thresholds, which are revised periodically, a European procedure applies.
Requirements for objectivity, transparency and non-discrimination protect fair competition. Functional specifications prevent vendor lock-in by imposing product-independent requirements on software and systems. EMVI criteria (Most Economically Advantageous Tender) evaluate quality, sustainability and innovation alongside price. Weighting of criteria determines the winning tender.
ARBIT conditions and BIZA model contracts provide standard frameworks for government ICT contracts. These conditions balance public interests with commercial reality of suppliers. Netherlands government organizations increasingly adopt agile procurement methods allowing iterative development and continuous feedback during project execution.
How does cybersecurity influence ICT law in the Netherlands?
The NIS2 Directive and Dutch Cybersecurity Act require essential and important entities to implement cybersecurity measures including technical protections, incident reporting and risk analyses. Supervisory authorities enforce compliance with fines up to €10 million or 2% of worldwide annual turnover.
Organizations categorized as essential entities include healthcare providers, financial institutions, energy suppliers and transport companies. Important entities encompass digital service providers, postal services and waste management organizations.
DORA Regulation specifically targets financial institutions with requirements for digital resilience and incident response. The Cyber Resilience Act (CRA) imposes security requirements on products with digital elements. Manufacturers bear lifelong responsibility for vulnerabilities in software and firmware.
Contracts distribute cybersecurity obligations between suppliers and clients. Suppliers guarantee security by design, timely patches and incident response. Clients implement access controls, backups and monitoring. Netherlands organizations conduct annual penetration tests and vulnerability scans to comply with certification requirements such as ISO 27001.
What role does artificial intelligence play in Dutch ICT law?
The EU AI Regulation (AI Act) categorizes AI systems by risk level: unacceptable, high, limited and minimal risk. High-risk AI such as credit scoring, personnel selection and facial recognition requires conformity assessment, documentation and human oversight.
Transparency obligations apply to chatbots and deepfakes so users recognize interaction with AI. Prohibited AI applications include social scoring systems and emotion recognition at workplaces or schools.
Liability for AI decisions is assessed under the general rules of the Dutch Civil Code, such as non-performance of a contract (Article 6:74 DCC) and unlawful acts (Article 6:162 DCC). Whether the developer of an AI system is also liable as the producer of a defective product (Article 6:185 DCC) depends on whether the software qualifies as a product in the case at hand.
What are dispute resolution methods for ICT conflicts in the Netherlands?
Alternative Dispute Resolution (ADR) can be faster and cheaper than civil proceedings. The Foundation for Automation Dispute Resolution (SGOA) in Heemstede organizes arbitration, binding advice and mediations for ICT disputes in the Netherlands.
The Netherlands Arbitration Institute (NAI) in Rotterdam handles complex, including international, ICT cases. Arbitration leads to a binding decision with limited options for review. To enforce an arbitral award in the Netherlands, leave from the interim relief judge is required (Article 1062(1) Dutch Code of Civil Procedure). Mediation often leads to solutions that satisfy both parties.
Rapid Conflict Resolution at SGOA combines elements of mediation and arbitration for quick decisions. Expert reports by members of the Dutch Professional Association for Sworn IT Experts (NVBI) support courts on technical aspects. Technical expertise proves crucial in disputes over software defects, security breaches and system performance.
How does domain name law work in the Netherlands?
SIDN administers .nl domain names on a first come, first served basis. Disputes over .nl domain names can be submitted to SIDN’s own dispute resolution procedure.
International domains (.com, .org, .net) follow the Uniform Domain Name Dispute Resolution Policy (UDRP). Bad faith in domain registration justifies transfer when the domain name is identical or confusingly similar to a trademark and the holder has no legitimate interest.
Pledges and attachments on domain names follow the regime for property rights. Bankrupt businesses lose domain names to the trustee unless third parties demonstrate separate rights. Netherlands courts recognize domain names as transferable property rights subject to execution and foreclosure.
How does data governance protect business data in Dutch law?
The Data Governance Regulation (DGA) facilitates voluntary data sharing between organizations through data intermediaries. The Data Act requires manufacturers of IoT devices to make data available to users and independent service providers under EU legislation applicable in the Netherlands.
Contractual restrictions on data sharing are void when they hinder reasonable access. Database Law protects investments in data collections representing substantial qualitative or quantitative investments. The database right expires fifteen years after 1 January of the year following completion or, if the database was made available to the public before completion, the year following that first availability; a substantial change that reflects a new substantial investment creates a new right for the resulting database (Article 6 Database Act).
Trade secrets and know-how receive protection under the Trade Secrets Directive against unlawful acquisition and use. In the Netherlands, the Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen) protects information that is secret, has commercial value because it is secret, and is subject to reasonable measures to keep it secret (Article 1). Non-disclosure agreements (NDAs) add contractual obligations, often secured by a penalty clause. Netherlands organizations include data ownership clauses in supplier agreements specifying rights to raw data, processed data and analytical insights.
What are telecommunications regulatory obligations in the Netherlands?
The Telecommunications Act ensures accessibility and quality of telecommunications facilities. Net neutrality prohibits internet providers from slowing down or blocking specific services under Dutch implementation of EU regulations.
Rates for internet access services may not depend on applications used. Roaming Regulation (EU 2015/2120) eliminates surcharges for mobile use in other EU member states since 2017. Consumers pay domestic rates during stays abroad. Fair use clauses prevent structural use of cheaper foreign subscriptions.
Unsolicited electronic marketing messages require the recipient’s prior consent (Article 11.7(1) Telecommunications Act). The same applies to marketing to natural persons by other means, such as telephone calls (Article 11.7(2)). Exceptions apply, among others, to electronic contact details that a business has designated for receiving such messages, and to own customers for similar products, provided they can easily opt out (Article 11.7(3)-(4)). The Dutch Authority for Consumers and Markets (ACM) supervises compliance (Article 15.1(3)).
Do you have legal questions about ICT contracts, cybersecurity or privacy protection? Our specialized lawyers in the Netherlands analyze your situation and advise on contract strategies, compliance obligations and dispute resolution. Technological innovation requires legal certainty in a rapidly evolving digital field.
Which developments are approaching ICT law in the Netherlands?
Quantum computing may in time threaten current encryption standards. Migration to post-quantum cryptography will require planning and investment, also under emerging security standards.
Legislation will impose minimum security requirements on critical systems. Blockchain technology demands legal frameworks for smart contracts, distributed databases and cryptocurrency. Liability distribution for autonomous contract execution remains unclear. Dutch case law must develop standards for this new contract form.
Metaverse platforms create legal questions about virtual property, cross-border law enforcement and copyright on digital creations. International harmonization lags behind technological development. Netherlands courts face challenges establishing jurisdiction and applicable law for disputes in virtual environments.
Frequently asked questions about ICT law in the Netherlands
What is ICT law?
ICT law, or IT law, is the set of rules that apply to information and communication technology: contracts for software, hardware, cloud and services (Books 6 and 7 of the Dutch Civil Code), copyright on software (Article 10(1)(12°) Copyright Act), database and trade secret protection, privacy and cybersecurity rules, telecommunications law and cybercrime. It is not a separate code but a combination of these fields.
Who owns the copyright in software developed by a freelancer in the Netherlands?
In principle, the freelancer as the maker (Article 1 Copyright Act). The employer rule of Article 7 only applies to employees who write the software as part of their job, unless agreed otherwise. Unless the software was made after the client’s design and under its direction and supervision, in which case the client is regarded as the maker (Article 6), a client obtains the copyright only through a written agreement and a deed of transfer (Article 2(3)). Without that, what the client may do depends on what follows from the agreement.
What does Article 138ab of the Dutch Criminal Code say?
It makes computer trespass a crime: intentionally and unlawfully intruding into an automated work or part of it, for example by breaking a security measure, a technical intervention, false signals or a false key, or assuming a false identity. The maximum penalty is two years’ imprisonment or a fourth-category fine, and four years in the aggravated cases of paragraphs 2 and 3 (Article 138ab Dutch Criminal Code).
Can an ICT supplier limit its liability under Dutch law?
Yes, limitations of liability are common. In general terms, a limitation can be annulled if it is unreasonably onerous (Article 6:233(a) DCC), but legal entities that have published their most recent annual accounts, parties with fifty or more employees, frequent users of the same or similar terms and business parties that are not both established in the Netherlands cannot invoke that rule (Articles 6:235 and 6:247(2) DCC). If Dutch law applies, a party cannot rely on a limitation to the extent that this would be unacceptable according to standards of reasonableness and fairness (Article 6:248(2) DCC).
Do cookies require consent in the Netherlands?
Yes, unless an exception applies. Consent and clear information are required for storing or reading information on a user’s device (Article 11.7a(1) Telecommunications Act). No consent is needed for cookies used only to carry out the communication, or that are strictly necessary for the requested service, or that measure the quality or effectiveness of the service with little or no impact on privacy (Article 11.7a(3)).
Primary sources
- Copyright Act (Auteurswet): Articles 1, 2, 6, 7, 10 and 45j
- Dutch Civil Code Book 6: Articles 6:74, 6:91, 6:92, 6:94, 6:162, 6:185, 6:196c, 6:233, 6:235, 6:247, 6:248 and 6:265 (Article 6:196c repealed with effect from 4 February 2025)
- Dutch Civil Code Book 7: Articles 7:401 and 7:754
- Dutch Criminal Code (Wetboek van Strafrecht): Articles 138ab, 138b, 317 and 350a
- Telecommunications Act (Telecommunicatiewet): Articles 11.7, 11.7a and 15.1
- Database Act (Databankenwet): Articles 2 and 6
- Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen): Article 1
- Dutch Code of Civil Procedure: Article 1062
