This page brings together our English guides on IT and technology law under Dutch and EU rules, grouped by subject. Most questions in this field come back to a handful of EU regulations, in particular the GDPR and the AI Act, read together with the Dutch Civil Code (Burgerlijk Wetboek, BW).

Technology changes quickly, but the underlying legal questions stay the same: who is responsible, what must you report, and who owns the result. Each guide below answers one of those questions for a specific situation. Pick the subject that matches yours and follow the links from there.

Handling personal data under the GDPR

If you process personal data, the General Data Protection Regulation (GDPR) applies directly in the Netherlands. The Dutch supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). You can read the full regulation text on EUR-Lex.

The guides below cover camera surveillance, online tracking, and the use of someone’s image without their consent.

Responding to a data breach or cyberattack

After a personal data breach, you must usually notify the AP within 72 hours under Article 33 GDPR. Some sectors carry additional reporting duties under separate cybersecurity legislation.

These guides explain what victims of an attack can claim, which reports are required, and how data security rules are developing.

Using AI and emerging technology responsibly

The EU AI Act (Regulation (EU) 2024/1689) sets rules based on the risk an AI system poses. Its obligations phase in over several years, so what applies to you depends on the type of system and the date. The official text is available on EUR-Lex.

The guides below cover liability for biased algorithms, ownership of AI output, internal AI policies, and the criminal law side of deepfakes.

Dealing with crypto and digital assets

Crypto assets, NFTs and decentralised organisations do not fit neatly into existing legal categories. Dutch courts and legislators apply the existing rules on property, companies and criminal law to them, at times with uncertain results.

Acting against harmful online content

If content about you appears online, or data from your platform is copied, several routes are available. These range from a takedown request to the platform to proceedings for an unlawful act (onrechtmatige daad) under Article 6:162 BW.

Drafting software, licence and IT contracts

Most IT disputes start with a contract that did not say clearly enough who delivers what, and who is liable when something goes wrong. These guides cover the role of an IT lawyer, transaction clauses, electronic signatures, and online gambling rules.

Finding guides in our other practice areas

In summary

The GDPR applies directly in the Netherlands, supervised by the Autoriteit Persoonsgegevens.
A personal data breach must usually be reported to the AP within 72 hours.
The AI Act is being phased in, so the rules that apply depend on the system and the date.
Online harm can often be addressed through a claim for an unlawful act under Article 6:162 BW.
A clear IT contract prevents most disputes about delivery and liability.

Law & More advises companies and individuals on privacy, technology contracts and online disputes, in English and Dutch.

Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.