Under Dutch law nobody owns data as such, so the data clause in your SaaS contract decides who may use, copy, export and delete the information you put into a cloud platform. The main exceptions are copyright, database right, trade secrets and the GDPR, which protect parts of your data by law; everything else is protected only as far as your contract says.
Article 3:2 of the Dutch Civil Code (Burgerlijk Wetboek, BW) defines a thing (zaak) as a tangible object capable of human control, and a data set is not tangible. Vague contract wording therefore does not leave the question open: in practice it settles it in the provider’s favour.
Table of contents
Why is data ownership a contract question, not a property question?
Dutch property law only knows things and property rights (goederen, Article 3:1 BW), and data is neither. You cannot deliver, pledge or reclaim data the way you can a server, so if your agreement says nothing useful about your data, you have no fallback position.
Four bodies of law do protect certain data:
- Copyright under the Dutch Copyright Act (Auteurswet) protects original text, images, drawings and software you upload or create, and it does not pass to the provider because it sits on their servers.
- The database right under the Databases Act (Databankenwet) protects a structured collection if you made a substantial investment in obtaining, verifying or presenting its contents; investment in creating the data itself does not count.
- The Trade Secrets Act (Wet bescherming bedrijfsgeheimen) protects confidential business information with commercial value, but only if you took reasonable steps to keep it secret.
- The GDPR protects personal data, but it gives rights to the individuals concerned, not to your company.
Transaction logs, telemetry, configuration settings, usage patterns, sensor readings and the analytics built on them usually fall outside all four. They are protected only by your agreement.
What goes wrong when the data clause is vague?
Vague data clauses produce five recurring problems. Each of them follows from standard provider terms rather than from bad luck.
| Risk | What it means in practice |
|---|---|
| Lock-in | No agreed export format, timetable or price, so switching costs more than staying. |
| Licence scope creep | A licence granted to deliver the service also covers product development, benchmarking and resale of aggregated insights. |
| Retrieval obstacles | Export is slow, chargeable or delivered in a proprietary format no other platform can read. |
| Accountability gap | Sub-processors and storage locations are undisclosed, so you cannot show the Autoriteit Persoonsgegevens (AP) that you comply. |
| Premature deletion | Data is erased at termination before you have finished migrating, without proof of what was deleted. |
A cloud agreement therefore deserves the same scrutiny as a lease or a distribution contract. Our overview of what to check in a cloud contract in the Netherlands sets out the wider commercial framework.
What should the data clause say?
A workable clause defines customer data, states that all rights in it remain with the customer, and limits the provider’s licence to the purpose of delivering the service. The purpose limitation carries the weight.
Compare two formulations. “A licence to use, reproduce, modify and distribute Customer Data”, granted perpetually and irrevocably, lets the provider build products on your information and keep doing so after you leave. “A licence to access and process Customer Data solely for the purpose of providing the Services under this Agreement”, ending when the agreement ends, does not.
Define customer data to include what your staff create inside the platform, such as tickets, comments, workflow configurations and annotations, not only what you upload. Deal expressly with derived and aggregated data, because a clause that only covers “Customer Data” leaves everything the provider computes from it unprotected.
How far does Dutch contract law protect you against unfair terms?
Less than most businesses expect. Most SaaS agreements use the provider’s general terms and conditions, governed by Articles 6:231 to 6:247 BW, but larger companies cannot invoke the main protections.
Under Article 6:234 BW the provider must give you a reasonable opportunity to read the terms before or when the contract is concluded; for electronic contracts, in a form you can store. Under Article 6:233(a) BW a term is voidable if it is unreasonably onerous. Under Article 6:235 BW, however, a party cannot rely on these grounds if it is a legal entity that has published its latest annual accounts, or if 50 or more people worked for it when the contract was concluded.
The remaining safety valve is Article 6:248(2) BW: a contract term does not apply where applying it would be unacceptable by standards of reasonableness and fairness. Courts apply this restrictively between businesses. For most established companies, negotiation before signing is the only real opportunity.
Does a foreign choice of law change this?
Partly. Under the Rome I Regulation a business-to-business choice of law is generally valid, and under the Brussels I bis Regulation so is a choice of court within the EU. That choice does not switch off the GDPR or the switching rules of the EU Data Act, which bind providers that serve customers in the EU wherever they are established. A promise to comply with the provider’s domestic privacy law instead of the GDPR is a defect.
How do you get your data back under the EU Data Act?
Since September 2025 the Data Act (Regulation (EU) 2023/2854) has applied, and its switching rules cover SaaS as well as infrastructure and platform services. They turn points that used to be negotiable into statutory minimum rights, regardless of the provider’s standard terms.
The provider must remove contractual, technical and commercial obstacles to switching to another provider or to your own infrastructure. The Regulation caps the notice period before switching starts, requires a transitional period in which the provider supports the move, and guarantees a minimum period to retrieve your data before it is erased. Export must be in a structured, commonly used and machine-readable format, through open interfaces.
Switching charges are being phased out: during the transition the provider may only charge its actual costs, and from 12 January 2027 it may not charge for switching or data egress at all. Contracts concluded on older terms should be re-read against these rules. For highly customised services, still put the export format, schema documentation and migration support in the contract: the statutory minimum is a floor, not a migration plan.
What must the processor agreement say about deletion and security?
Where the platform holds personal data, you are usually the controller and the provider the processor, and Article 28 GDPR requires a written processor agreement. At the end of the contract the processor must, at your choice, delete or return all personal data; a clause that lets the provider choose does not meet that standard.
Our explanation of the roles of controller and processor under the GDPR helps you establish who is who, and our guide to the data processing agreement covers the drafting.
Backups are where deletion promises usually fail. Backups are not edited record by record; the accepted approach is that data marked for erasure is put beyond use, is not restored into live systems, and disappears when the backup is overwritten. The contract should state the backup rotation period, guarantee that flagged data is not restored and require a written confirmation of deletion.
Article 32 GDPR requires appropriate security measures from controller and processor. Tie them to a certification the provider holds and will maintain, such as ISO/IEC 27001, with an audit right. Since the Cybersecurity Act (Cyberbeveiligingswet) entered into force on 15 August 2026, entities within its scope must give an early warning of a significant incident to their CSIRT and competent authority within 24 hours and a fuller notification within 72 hours (Articles 26 and 27 Cyberbeveiligingswet). You can only meet those deadlines if your provider must alert you within hours.
Sub-processors, data location and audits
Under Article 28(2) GDPR a processor needs your authorisation before engaging a sub-processor, and with a general authorisation must inform you of changes so you can object. The contract should fix the notice period and allow you to terminate without penalty, with a full export, if you object.
If personal data leaves the European Economic Area, Chapter V GDPR requires a transfer mechanism such as an adequacy decision or the European Commission’s standard contractual clauses. Require the provider to switch to an alternative mechanism at its own cost if the one in use falls away, and to disclose from which countries support staff can access your data. Make sure the audit clause allows follow-up questions and an inspection after an incident, not just an annual report.
Who owns derived data and AI training data?
Nobody by law, so the contract decides. Derived data is what the provider computes from your data: benchmarks, predictions, efficiency reports and model weights trained on your data set.
Watch the “service improvement” clause, typically a right to use anonymised or aggregated data to develop the provider’s services and models. Anonymisation is a high bar under the GDPR: pseudonymised records, or aggregates detailed enough to identify a single customer, remain personal data. And anonymous data can still reveal your prices, margins, client mix and processes to a product sold to your competitors.
Trade secret protection only helps if you took reasonable steps to keep information secret, and consenting to its use for model training is close to the opposite. The EU AI Act regulates how AI systems are developed and used but does not allocate rights in training data or output. A protective clause states that all rights in raw, derived and aggregated data remain with you, and that product development, benchmarking or model training requires your prior written consent case by case.
Are liability caps in SaaS contracts valid under Dutch law?
In principle, yes. Dutch law accepts exoneration clauses between businesses, and providers usually cap liability at the fees paid over six or twelve months, a fraction of the loss in a serious data breach.
Under Article 6:248(2) BW relying on a cap is unacceptable in particular where the damage was caused by intent or conscious recklessness of the provider or its management, according to Supreme Court case law. A party not excluded by Article 6:235 BW can also challenge the cap under Article 6:233(a) BW. Both routes are argued after the loss and at a cost; negotiating is cheaper.
Insist on two carve-outs: breach of confidentiality and security obligations outside the general cap, and an uncapped intellectual property indemnity. A cap between you and the provider does not limit claims by individuals under Article 82 GDPR or fines by the AP, which for the most serious infringements can reach 4% of worldwide annual turnover.
What happens to your data if the provider goes bankrupt?
Under Article 37 of the Bankruptcy Act (Faillissementswet) you can give the trustee (curator) a reasonable written deadline to confirm whether the contract will be performed. If the trustee does not confirm, he loses the right to demand performance from you, but the service is not kept running.
Source code escrow alone does not solve this, because the code is useless without the environment, configuration and data. A working continuity arrangement combines regular deposit of source code and build instructions, a current copy of your data in a documented format outside the provider’s estate, and a release trigger that covers insolvency and prolonged service failure. See our articles on escrow arrangements and software escrow in the Netherlands.
How does weak wording compare with protective wording?
Weak wording describes an outcome; protective wording commits the provider to a mechanism you can test against a format, a period or a named standard.
| Clause | Weak wording | Protective wording |
|---|---|---|
| Rights in data | You retain ownership of the data you submit. | All rights in Customer Data, including derived and aggregated data, remain with the Customer; the Provider may only host and process it to provide the Services, until termination. |
| Export and switching | Data can be exported on termination for a fee. | The Provider supports switching under Regulation (EU) 2023/2854 and exports in a structured, machine-readable format, charging no more than the Regulation permits. |
| Use for development | We may use anonymised data to improve our services. | No use for product development, benchmarking, model training or marketing without prior written consent case by case. |
| Deletion | Data is removed from active systems at termination. | After the retrieval period, data is deleted from production, archive and backups within the documented rotation, never restored, and deletion is confirmed in writing. |
| Liability | Capped at twelve months’ fees. | Confidentiality and security breaches outside the general cap; IP indemnity uncapped. |
What should you check as a customer?
- Does the provider’s licence end at termination and cover only delivery of the service?
- Are derived and aggregated data expressly yours, and is model training excluded without your consent?
- Is export guaranteed in a documented, machine-readable format, at no more than the Data Act allows?
- Does deletion cover backups, with a written confirmation?
- Must the provider notify incidents within hours, so you can meet the 24-hour Cyberbeveiligingswet deadline if it applies to you?
- Are confidentiality, security and the IP indemnity outside the liability cap?
What should you check as a SaaS provider?
- Do your terms comply with the Data Act switching rules, including the phase-out of switching charges by 12 January 2027?
- Does your processor agreement meet Article 28 GDPR, including deletion or return at the customer’s choice?
- Is your sub-processor list current, with a notice and objection procedure?
- Are your service-improvement and AI training rights clearly limited and genuinely based on anonymised data?
- Have you provided your general terms in a form customers can store, as Article 6:234 BW requires?
Our IT law guides set out the wider framework.
What can we do for you with SaaS contracts and data?
Our IT lawyers review and negotiate SaaS and cloud agreements for Dutch and international businesses:
- We review your SaaS agreement and processor agreement and mark every clause that affects rights in your data.
- We draft protective wording on data rights, derived data, export, deletion and liability.
- We check existing contracts against the Data Act switching rules and the Cyberbeveiligingswet.
- We set up continuity and escrow arrangements with a workable release trigger.
- We conduct negotiations with the provider or, if you are the provider, draft compliant standard terms.
- We act in disputes with providers when an exit or data return goes wrong.
Summary
- Data is not a thing under Article 3:2 BW, so your contract decides who may use it.
- Limit the provider’s licence to delivering the service and include derived and aggregated data.
- Larger companies cannot rely on the unfair-terms rules of Article 6:233 BW (Article 6:235 BW); negotiate before signing.
- The Data Act gives minimum switching and export rights and abolishes switching charges from 12 January 2027.
- Secure deletion of backups, fast incident notification and a continuity arrangement for insolvency.
Frequently asked questions
Which clause in a SaaS contract matters most for my data?
The clause defining the provider’s licence to your data. A statement that you keep ownership is worth little if the next paragraph grants a perpetual, worldwide licence for any purpose. Look for a purpose limitation, an end date at termination and an express reference to derived and aggregated data.
Can I get my data back if my provider goes bankrupt?
Only if you arranged it in advance. The trustee is not obliged to keep the service running, and a contractual export right against a bankrupt company is only a claim. A continuity arrangement with a current copy of your data outside the provider’s estate is the reliable protection.
Does GDPR compliance protect my company’s data rights?
No. The GDPR gives rights to individuals in respect of their personal data, not to your company. A provider can comply fully with the GDPR and still hold a licence to exploit your commercial data, so you need separate clauses.
Does the Data Act override my SaaS contract?
For switching, largely yes: it sets minimum rights on notice, transition, export format and charges that a contract cannot undercut. It does not decide who may use your data during the term or who owns derived data; that remains a matter for the contract.
