In a Dutch acquisition, the seller does not have to volunteer everything: the buyer has a duty to investigate, and the seller has a duty to disclose what it knows is material to the buyer. Where that balance lies depends on what the buyer could reasonably have discovered and what the seller knew, which is why the data room should be read line by line rather than skimmed; the main exception is what the parties agree otherwise in the warranties of the purchase agreement.

The problems that surface late are consistent: revenue booked too early, liabilities kept off the balance sheet, threatened claims, software never transferred, and privacy or cyber incidents never reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

For each of the fifteen issues below, we list the documents and questions that bring it to light.

Table of contents

How does Dutch law divide the risk between buyer and seller?

Through the duty to investigate and the duty to disclose, and above all through the purchase agreement. The warranties and indemnities in the share purchase agreement (SPA) usually decide who bears a risk that materialises after closing.

Under Dutch law, a buyer who was misinformed can invoke mistake (dwaling, Article 6:228 of the Dutch Civil Code) or, in an asset deal, non-conformity (Article 7:17). A seller’s duty to disclose generally takes precedence over the buyer’s duty to investigate: a buyer may usually rely on information that the seller has given. But the more professional the buyer and the more advisers involved, the more the courts expect from the buyer’s own investigation.

In practice, Dutch SPAs often exclude these statutory remedies and replace them with a contractual system of warranties, disclosure against those warranties, limitation periods and caps. That makes the due diligence even more important: what was fairly disclosed in the data room is usually no longer a basis for a claim.

1. Is the revenue overstated?

Check whether the revenue shown was actually earned in the period. Revenue booked too early is one of the most common ways to make a business look better than it is.

Red flags:

shipments recorded as revenue at the end of a quarter while the goods are still on site;
a wave of credit notes in the first weeks of the next period;
deferred revenue shrinking while invoiced sales rise sharply.

What to do: match sample invoices to shipping documents and proof of delivery, test the cut-off around two period ends, compare the timing of payments received with invoice dates, and read the auditor’s management letter for comments on revenue recognition.

2. Are the customer metrics reliable?

Rebuild the key metrics yourself from the raw data. Metrics such as churn, customer acquisition cost and active users are not audited like the annual accounts, so they are easy to polish.

Common tricks: counting free trials or dormant accounts as paying customers, briefly reactivating former customers so they count as active, and leaving marketing costs or founders’ salaries out of the CAC calculation.

What to do: ask for cohort exports and rebuild the churn tables yourself, reconcile CRM figures with invoices and payments received, and sample usage logs for bots or duplicate accounts.

3. Are there hidden debts or off-balance-sheet liabilities?

Look beyond the balance sheet. Debt can be parked in structures that do not show up as borrowings but will still cost cash after closing.

Typical examples:

leases presented as service contracts;
supplier finance or reverse factoring that pushes payments to suppliers beyond the year end;
separate entities that hold real estate or equipment with their own debt;
earn-outs or royalty obligations that are not included in the net debt figure;
guarantees, including a group guarantee under Article 2:403 of the Dutch Civil Code (a 403-verklaring) that makes the target liable for the debts of group companies.

What to do: read the notes to the accounts for guarantees, letters of credit and take-or-pay obligations. Request direct bank confirmations and covenant compliance certificates for all facilities, including unused ones, and check the Commercial Register (KVK) for filed 403 declarations and the land registry (Kadaster) for mortgages.

4. Are there pending or threatened claims?

Ask for a full list of current, threatened and recent disputes, and check it against correspondence and invoices from lawyers. Claims that have been threatened but not yet filed are often left out.

Under the accounting rules (IAS 37, and the Dutch Guideline RJ 252), a claim whose chance of success is remote need not be disclosed.

The Netherlands has no public court docket that you can search. Only a selection of judgments is published on rechtspraak.nl. You therefore depend on what the seller provides and on your own targeted questions.

What to request:

letters from external lawyers and an up-to-date overview of disputes;
invoices from lawyers and bailiffs over the past years, which often reveal disputes that are not on the list;
insurance policies with limits, deductibles and exclusions, and claims notified to insurers;
correspondence with regulators and the Tax and Customs Administration (Belastingdienst).

Then calculate a worst case: what if every claim is lost, plus legal costs, minus what the insurance covers? Compare that with the escrow and the limitation of liability in the SPA. If you take out warranty and indemnity (W&I) insurance, check that it does not exclude the very claims you have just found, because known issues are normally excluded.

5. Does the company really own its intellectual property?

Trace the chain of title of every important right. Under Dutch law, copyright in software written by an employee usually belongs to the employer, but software written by a freelancer or an agency stays with its maker unless it was transferred in writing.

Common problems:

code written by freelancers without a written deed of assignment (Article 2 of the Dutch Copyright Act, Auteurswet);
patents that expire earlier than stated, or were never registered in key countries;
a joint venture partner or former founder who has kept rights or licences;
open-source components under licences that require the source code to be disclosed.

What to do: trace the chain of title from creation to the current owner, scan the source code for open-source licences, and consider a freedom-to-operate opinion for the most important markets. Also check whether know-how is protected as a trade secret: under the Dutch Trade Secrets Act (Wet bescherming bedrijfsgeheimen), information is only protected if the company has taken reasonable measures to keep it secret.

Solutions: make the signing of missing deeds of assignment a condition for closing, place critical source code in escrow, and agree a separate, higher cap for IP warranties.

6. Does the company comply with privacy, sustainability and sector rules?

Check the actual practice, not just the policies. Breaches rarely show up in the accounts, so you find them in correspondence, registers and conversations with the people who do the work.

Under Article 83 of the GDPR, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) can impose fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.

Areas that deserve attention:

GDPR: records of processing, consent, data processing agreements and the handling of access requests;
anti-money laundering and customer due diligence under the Dutch Wwft, for example in fintech;
sustainability reporting and claims about the supply chain, on which the Authority for Consumers and Markets (ACM) is active;
sector licences, such as energy supply licences or CE marking of medical devices.

What to do: ask for all correspondence with regulators, including warning letters; interview line managers, not only the compliance officer; review whistleblower reports and how they were followed up; and test a high-risk process, such as handling an access request.

7. Have there been cyber incidents or security weaknesses?

Ask for the register of personal data breaches and the incident log, and have an independent test carried out. Cyber problems often stay invisible until a regulator or an attacker brings them to light.

Under Article 33 of the GDPR, a personal data breach must generally be reported to the Dutch Data Protection Authority within 72 hours, and every breach must be documented internally, even if it was not reported. A missing or suspiciously empty register is itself a red flag. Poor information security can lead to fines, downtime and claims from customers.

How incidents are hidden:

a ransom paid without a report to the authority or the police;
incidents logged as “IT maintenance” so they do not reach the board;
settlements with confidentiality clauses.

Technical red flags:

critical security updates that take months to install;
shared administrator accounts on production systems;
penetration test reports with serious findings that have not been resolved for a year or more.

What to do: commission an independent penetration test focused on the most critical data, check whether credentials or source code have been leaked, review the incident response plan and whether it was tested, and compare the cyber insurance cover with a realistic worst case.

8. Are the forecasts realistic?

Test the forecast against the company’s own track record. Five-year forecasts often show a sharp upward curve in the later years that the current pipeline cannot support.

Tests: compare earlier budgets with actual results (large deviations are a warning sign), check the pipeline against historical win rates, and stress prices and churn to see where EBITDA breaks.

In negotiation, you can link part of the price to actual performance through an earn-out. Tie it to cash or a clearly defined EBITDA, not to revenue alone, and define the calculation precisely, because earn-outs are a frequent source of disputes.

9. Are workers correctly classified, and are there hidden employment liabilities?

Check whether freelancers are really self-employed and whether all employees are paid in line with the law and the collective agreement. Misclassification can lead to back taxes, social security contributions and claims.

In the Netherlands, the Tax and Customs Administration has fully enforced the rules on false self-employment again since 1 January 2025. Back taxes can be imposed for work performed from 2025 onwards, and fines are possible in serious cases. Someone who is in fact an employee may also claim holiday pay, continued pay during illness, pension and protection against dismissal.

Hidden costs:

back taxes on wages and employer contributions;
unpaid overtime, holiday pay and holiday entitlements;
mandatory participation in an industry pension fund that was not applied;
fines under the Foreign Nationals Employment Act (Wet arbeid vreemdelingen) for staff without a valid work permit, imposed per worker.

What to do: compare freelancers’ invoices with the hours worked and look for exclusivity and integration into the organisation; sample payslips for overtime and correct payroll tax; and check that the company holds copies of valid identity and residence documents for every employee, as it is required to do. In a share deal, all these liabilities stay with the company. In an asset deal, employees transfer automatically with the business under Article 7:663 of the Civil Code, and the buyer takes over the obligations under their employment contracts, including those that arose before the transfer; the seller remains jointly liable with the buyer for one year.

Solutions: an escrow sized to the potential tax assessments, specific indemnities, and correcting the contracts after closing.

10. Does the business depend on a few customers or suppliers?

Analyse how revenue and purchasing are spread. A pipeline that looks diversified can rest on a few large customers, one critical supplier or one market.

Forms of concentration:

customers: a large share of revenue from one account;
suppliers: a critical component from a single supplier;
geography: revenue concentrated in one region or currency;
technology: sales that depend on a platform the company does not control.

Also check the contracts with key customers and suppliers for change-of-control clauses. Such a clause may allow the other party to terminate once the shares change hands.

What to do: carry out a Pareto analysis of revenue over the past twelve months and of the pipeline, and model the effect of losing a major customer, currency movements and a supplier failure. Solutions include earn-outs linked to customer spread, securing alternative suppliers, and obtaining consent from key contract parties before closing.

11. Do the EBITDA adjustments hide weak cash flow?

Check every adjustment in the quality of earnings report. By labelling recurring costs as one-off and capitalising ordinary expenses, a seller can make an average business look like a cash machine on paper.

Adjustments to scrutinise:

“one-off” or “strategic” items that come back every year;
private costs of the founder booked as marketing or research;
ordinary IT costs capitalised as intangible assets.

What to do: reconcile EBITDA minus investments minus changes in working capital with the actual operating cash flow; roll forward the working capital schedules to spot seasonal window dressing; and trace customer prepayments to the delivery obligations they create.

If the cash conversion is weak, you can adjust the price or move part of it into an earn-out, base the financing covenants on real rather than adjusted EBITDA, or walk away before you inherit a liquidity problem.

12. Are there environmental or health and safety risks?

Have every site investigated, and read the permits and correspondence with the environmental authorities. Soil pollution, asbestos or a product safety problem can turn a bargain into a money pit.

Typical hidden issues:

soil contaminated by old fuel tanks or former industrial activity;
asbestos in older buildings;
hazardous substances or waste not properly registered;
product batches that are the subject of an ongoing safety investigation.

Under Dutch law, the authorities can require the owner or user of a site to investigate and remediate soil contamination. In a share deal, that risk stays with the company you are buying, whoever caused it. Environmental liability should therefore be dealt with in specific warranties and indemnities, not left to general rules.

What to do: commission environmental site assessments (phase 1, and where necessary phase 2 with soil sampling), check the public soil information (Bodemloket), ask for all correspondence with the regional environmental service (omgevingsdienst) and the Dutch Labour Authority (Nederlandse Arbeidsinspectie), and walk the site with an expert.

13. Are there related-party transactions on unfavourable terms?

Check all contracts with shareholders, directors and their companies. Favourable deals with a landlord owned by the founder, or a sister company that charges too much for materials, shift profit to insiders and leave the buyer paying inflated costs after closing.

What to do: compare supplier and customer names with the shareholder and director registers in the Commercial Register, review the transfer pricing documentation for margins that are out of line with market practice, and request bank statements to spot payments to undisclosed related parties.

Recalculate the costs at market rates and apply your valuation multiple: the effect on the price can be material. Decide which contracts must end or be renegotiated at closing, and include that in the SPA.

14. Does the website or app use misleading designs?

Walk through the customer journeys yourself. Designs that push consumers into subscriptions, hide cancellation options or create false urgency (so-called dark patterns) are increasingly targeted by regulators and can create legal time bombs.

In the Netherlands, the ACM enforces the rules on unfair commercial practices and has taken action against webshops that use misleading countdown timers and other forms of pressure selling. Online platforms are prohibited from using deceptive interface designs under Article 25 of the EU Digital Services Act. Under the GDPR, consent must be freely given, so pre-ticked boxes are not valid consent.

Risky designs:

a subscription that continues automatically after a free trial without clear consent;
cancellation options that are hard to find or require many steps;
false urgency messages, for example “only 2 left” shown permanently.

What to do: have a lawyer-led walkthrough of the main customer journeys on mobile and desktop, check whether data shows deliberate misdirection, keep screenshots and recordings as evidence, and require remediation or an escrow before closing.

15. Is the seller controlling what you see in the data room?

Insist on full, searchable access and an audit trail. A seller that controls the data room controls what you see and when.

How a closed data room works:

folders only visible during supervised screen-sharing sessions;
access that expires before your advisers have finished;
no downloads or exports, only images that cannot be searched.

What to do: ask for a log showing who added, removed or viewed documents; insist on raw ledger data in a machine-readable format; and use a clean team under a confidentiality agreement for commercially sensitive information, especially if buyer and seller are competitors, because exchanging such information too early can breach competition law.

What do you do with a finding?

Every red flag needs a price or a remedy before signing. The usual tools are a price adjustment, a specific indemnity, a warranty, an escrow, a condition for closing, or the decision not to proceed.

A general warranty is often not enough for a risk you already know about, because disclosure in the data room usually excludes a claim. For known risks, a specific indemnity works better: the seller then pays for that particular risk if it materialises, regardless of disclosure. Also check the limitation periods and caps for each type of claim.

What should you check as a buyer?

Check that every material red flag has a price adjustment, specific indemnity, escrow or closing condition before you sign.
Check whether the SPA excludes mistake (Article 6:228 BW) and non-conformity, and what replaces them.
Check the limitation periods and caps for each type of claim, including a separate cap for tax and IP.
Check whether your W&I insurance excludes the issues you have found.
Check the change-of-control clauses in key contracts and obtain consents before closing.

What should you check as a seller?

Disclose known material issues in the data room, because a seller’s duty to disclose generally prevails over the buyer’s duty to investigate.
Prepare a full disclosure letter against the warranties, so that fairly disclosed matters cannot found a claim.
Have missing IP assignments and contractor agreements signed before the sale process starts.
Check that the de minimis threshold, basket and cap in the SPA match your risk.
Keep an audit trail of what was in the data room and when.

What can we do for you with due diligence?

Our corporate and M&A lawyers act for buyers and sellers in Dutch acquisitions.

We review the data room and report the legal red flags with an estimate of their impact.
We draft the warranties, specific indemnities and escrow arrangements in the SPA.
We check IP chain of title, employment status and regulatory correspondence.
We prepare the disclosure letter for a seller.
We handle warranty claims after closing, within the contractual notice periods.

Summary

Under Dutch law, the buyer must investigate and the seller must disclose; in practice, the warranties and indemnities in the SPA decide who bears which risk.
Rebuild revenue and customer figures yourself and add off-balance-sheet obligations to the net debt.
Check claims, IP ownership, privacy and cyber security, and employment status, because these rarely show up in the accounts.
Look for dependence on a few customers or suppliers, change-of-control clauses and related-party contracts.
Deal with known risks through specific indemnities, an escrow or conditions for closing, and be willing to walk away.