Cloud, hosting and colocation contracts under Dutch law: what to check

Dutch law has no specific contract type for cloud, hosting or colocation. A court looks at what was agreed and usually treats SaaS, PaaS and managed hosting as a contract for services (opdracht, Article 7:400 of the Dutch Civil Code, BW), while colocation of space and dedicated hardware can have lease features (huur, Article 7:201 BW).

Since 12 September 2025 the EU Data Act also gives cloud customers mandatory switching rights. The supplier’s standard terms decide most other points, so the service levels, liability cap and exit clause need to be negotiated before you sign.

What do you actually buy: colocation, hosting, IaaS, PaaS or SaaS?

The further down the stack you sit, the more operational risk is yours; the further up, the more you depend on the supplier. That determines what the contract must protect.

How does Dutch law characterise a cloud contract?

Most cloud contracts are services contracts (opdracht), often mixed with other elements (Article 6:215 BW). Software and data are not tangible things under Article 3:2 BW, so a pure SaaS contract is not a lease.

The characterisation matters. Under Article 7:408 BW a client can in principle terminate a services contract at any time, but between businesses that rule can be excluded and templates usually do so with fixed terms and long notice. Article 7:401 BW requires the supplier to act as a good contractor; Dutch courts use that duty of care to hold IT suppliers to duties to investigate and warn. For a perpetual licence against a one-off payment, the Supreme Court applied the rules on sale in De Beeldbrigade (ECLI:NL:HR:2012:BV1301, 27 April 2012).

What makes a service level agreement enforceable?

An SLA only protects you if availability is measurable and failure has consequences. Check what is measured, over which period, by whom and what is excluded: 99.9% measured per year allows one long outage, measured per month it does not.

Availability is not performance. Agree response times, support times per priority, recovery time and recovery point objectives, and a tested backup restore. Supplier terms often make service credits the exclusive remedy; carve out persistent, wilful or security-related failures and add a right to terminate for repeated or serious failure.

Who is responsible for security?

The party that controls a component carries the risk for it. In ECLI:NL:GHARL:2025:1046 (25 February 2025) the Arnhem-Leeuwarden Court of Appeal rejected a municipality’s claim against its IT supplier after a ransomware attack: the supplier only owed functional monitoring, and the attackers had entered through a firewall change and an administrator account managed by the municipality itself.

The customer also has a duty to cooperate: supplying information, deciding on time and testing. A customer who fails can be in creditor’s default (Article 6:58 BW), which blocks claims against the supplier. Specify security by standard, for example ISO/IEC 27001 covering the service you buy, with patching deadlines, incident notification and an audit route.

Sector rules can add mandatory contract content. Financial entities must follow DORA (Regulation (EU) 2022/2554) for ICT contracts, and the Dutch Cyberbeveiligingswet, implementing NIS2, has applied since 15 August 2026 to essential and important entities, including cloud and managed service providers.

What must the contract say about personal data and data location?

If the supplier processes personal data for you, you need a processing agreement under Article 28 GDPR covering instructions, security, sub-processors, breach notification and return or deletion at the end. Negotiate prior notice and a right to object for new sub-processors.

For transfers to the United States, the EU-US Data Privacy Framework remains in force; the EU General Court dismissed a challenge to it on 3 September 2025 (Latombe, T-553/23). Ask in writing where data, backups and logs are stored, from where support staff can access them, and whether you can fix the region. Under the Data Act, providers must also state which jurisdiction their infrastructure is subject to.

What does the EU Data Act require when you switch providers?

The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025, also to contracts concluded earlier. Providers of data processing services, which covers IaaS, PaaS and SaaS, must remove obstacles to switching and include mandatory terms in the contract.

• A maximum notice period of two months to start switching (Article 25).
• A transitional period of in principle 30 calendar days, which the provider can extend to up to seven months if switching is technically unfeasible.
• A data retrieval period of at least 30 days, followed by erasure.
• Until 12 January 2027 only reduced, cost-based switching charges; after that date switching charges are prohibited (Article 29).

Pure colocation falls outside this regime. And the Data Act does not make data portable if you built on proprietary services without an equivalent elsewhere, so negotiate the exit clause anyway.

What should the exit clause cover?

An exit clause negotiated at the start is worth more than any other clause, because at the end you have no leverage. It should cover format, scope, a transition period, assistance and deletion, and apply on any termination, including termination for your non-payment.

If your supplier goes bankrupt, the trustee decides under Article 37 of the Bankruptcy Act (Faillissementswet) whether to continue the contract. Source code escrow does little for SaaS on its own; you also need the data, the environment and a right to keep operating, and the contract should state that the data is yours and not subject to any right of retention.

Will a Dutch court enforce the supplier’s liability cap?

Usually yes, between businesses. Reliance on the cap fails only if that would be unacceptable by standards of reasonableness and fairness (Article 6:248 paragraph 2 BW), and courts apply that test with restraint; intent or deliberate recklessness generally defeats a cap.

Many Dutch suppliers use the NLdigital Terms (NLdigital Voorwaarden), which cap direct loss, exclude indirect loss and set a deadline for claims; check which edition applies and whether it was varied. If the terms are general terms, an unreasonably onerous clause can be annulled under Article 6:233 BW. Negotiate a cap that bears relation to the real harm, put data loss, security, confidentiality and IP outside it, and cap price indexation.

Which law and court should you choose?

Choose Dutch law and a Dutch or EU forum where you can: enforcing a judgment within the EU is straightforward, outside it often is not. Against a non-EU supplier, contract with its EU entity or consider arbitration. See our article on how to avoid jurisdiction and enforcement issues.

What should you check as a customer?

• Is the service defined per layer, with each security control assigned to one side?
• Is availability measurable, and are recovery objectives and a tested restore agreed?
• Are service credits not the exclusive remedy, and is there a termination right for serious failure?
• Does the exit clause cover format, transition, priced assistance, deletion and every type of termination?
• Does the liability cap match the loss a real failure would cause?

What should you check as a supplier?

• Do your terms meet the Data Act switching rules, including the ban on switching charges from 12 January 2027?
• Have you recorded which controls the customer keeps, such as its own admin accounts and firewall changes?
• Have you warned the customer in writing about risks and unsuitable choices, in line with your duty of care?
• Do DORA or the Cyberbeveiligingswet apply to you or your customer, and does the contract reflect that?
• Are your general terms provided in time so you can rely on them?

What can we do for you with a cloud, hosting or colocation contract?

Our IT lawyers act for customers and suppliers of cloud and hosting services.

• We review the contract and the SLA and list the main risks.
• We negotiate service levels, the liability cap and the exit clause.
• We check the contract against the Data Act, the GDPR, DORA and the Cyberbeveiligingswet.
• We draft the processing agreement and the continuity arrangement.
• We act in disputes about outages, data loss or termination.

Summary

• Cloud contracts are usually services contracts (Article 7:400 BW); colocation can have lease features.
• The supplier owes the care of a good contractor, but the customer must cooperate and is responsible for the controls it keeps.
• The Data Act applies since 12 September 2025: two months’ notice, a 30-day transition and no switching charges from 12 January 2027.
• Liability caps hold between businesses unless reliance is unacceptable under Article 6:248 BW.
• Negotiate the exit clause first.

Frequently asked questions