Last updated on 27 October 2026

Computer intrusion (computervredebreuk) is intentionally and unlawfully gaining access to an automated system (geautomatiseerd werk), such as a computer, phone, server or online account. It is often called hacking. It is a criminal offence under article 138ab of the Dutch Criminal Code (Wetboek van Strafrecht, Sr), with a maximum penalty of two years’ imprisonment.

Table of contents

Legal basis

Computer intrusion is a serious offence (misdrijf). The basic offence in article 138ab(1) Sr carries up to two years’ imprisonment or a fourth-category fine. Article 80sexies Sr defines what counts as an automated system.

The law gives examples of unlawful access: breaking through security, a technical intervention, using false signals or a false key, or posing as someone else. These are examples only. You can commit the offence without cracking any security.

There are two aggravated forms, each with up to four years’ imprisonment. The first applies if you then copy, intercept or record data (paragraph 2). The second applies if, through a public network, you use computing capacity to benefit yourself, or you move on from that system into a third party’s system (paragraph 3). Deleting or changing data is a separate offence (article 350a Sr).

How it works in practice

Companies and individuals report the offence to the police (aangifte). Larger cases go to specialised cybercrime teams of the police and the Public Prosecution Service (Openbaar Ministerie, OM). They request login data and IP addresses from providers and seize computers and phones.

Computer intrusion often comes together with other offences, such as fraud, extortion or money laundering. The public prosecutor then usually summons the suspect for all offences together. In a simple case, such as logging into an ex-partner’s account, a penal order (strafbeschikking) is also possible.

Common pitfalls

A common mistake is to think that logging in with a known password is not hacking. If you know a password but have no right to use it, you can still be accessing the system unlawfully. This often comes up with ex-partners and former employees who still have access.

A second pitfall is investigating a security flaw yourself. If you find a vulnerability and go further than needed, you may be committing an offence. Report it through the organisation’s own procedure where possible (responsible disclosure). The prosecution service takes this into account, but a report does not give you immunity.

For victims: keep log files and screenshots, and then change your passwords. If you wipe or restore everything first, you often lose the evidence the police need.

Our criminal lawyers assist suspects and victims in cases involving computer intrusion.