Quantum computing and data security: which legal rules apply?

No Dutch or European law regulates quantum computing as such. What applies is the existing law on information security, and it raises one concrete question: will the security measures you take today still be adequate when data encrypted now can be decrypted later? The main exception is export control and investment screening, which do contain specific rules for quantum technology.

Three obligations already apply. Article 32 of the General Data Protection Regulation (GDPR, in Dutch AVG) requires security measures that take account of the state of the art. That is a moving standard, not a fixed one, and it also covers data that must remain confidential for years, such as medical records, personnel files and legal archives. The Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements the EU NIS2 Directive, requires organisations in the designated essential and important sectors to manage the risks to their networks and information systems, and makes the management body responsible for approving those measures. For financial entities, the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) adds its own requirements on cryptographic controls and third-party risk.

The practical risk is not that someone decrypts your traffic today. It is that encrypted data is intercepted and stored now, to be decrypted once the capability exists. For data with a long confidentiality period, that makes the migration to post-quantum cryptography a present task rather than a future project. International standards for these algorithms have been published and are being adopted.

Quantum technology also brings export control and investment screening into play. Certain quantum items are dual-use goods under European export control rules, and investments in Dutch companies active in quantum technology can be subject to a security screening.

Why does quantum computing raise legal questions about data security?

Because a sufficiently powerful quantum computer could break the encryption on which much of today’s data protection relies. The law does not name quantum computing, but it requires security that matches the risks.

The same power creates a security problem. The public-key encryption that protects much of our digital communication, from online banking to digital signatures, relies on mathematical problems that ordinary computers cannot solve in any practical time. A sufficiently large and stable quantum computer could solve some of those problems. When such a computer will exist is uncertain, but the risk is taken seriously by governments and security services.

What is the core legal challenge?

The challenge is to protect sensitive data against a future threat with the legal tools that exist today. Those tools are open standards such as ‘state of the art’ and ‘appropriate measures’.

Any legal approach must deal with a number of concerns:

• Protecting existing data: attackers can collect encrypted data today and store it until they can decrypt it. This is known as ‘harvest now, decrypt later’.
• New standards: organisations must move to post-quantum cryptography (PQC), new encryption methods designed to resist attacks by both ordinary and quantum computers.
• Liability: if a data breach occurs because encryption was outdated, the question is who is responsible: the organisation, its supplier or both.
• Innovation: rules must not needlessly hinder research into, and the use of, quantum technology.

How does quantum computing threaten modern encryption?

Quantum computers can efficiently solve the mathematical problems on which public-key encryption is based. Symmetric encryption, such as AES with long keys, is considered much less vulnerable.

Why is public-key cryptography vulnerable?

Public-key cryptography relies on problems such as factoring very large numbers. A quantum computer could solve those problems in a practical time.

This system underlies secure websites (HTTPS), VPN connections, e-mail encryption and digital signatures. Its strength lies in the difficulty of certain mathematical problems, such as factoring very large numbers into prime numbers or the discrete logarithm problem. For an ordinary computer, solving these problems for the key sizes in use would take an impractically long time.

A sufficiently powerful quantum computer could solve these problems efficiently. Symmetric encryption, such as AES, is affected to a lesser extent: longer keys, such as AES-256, are generally considered adequate. The legal framework for data security must therefore focus mainly on the public-key systems.

What is Shor’s algorithm?

Shor’s algorithm, published in 1994, is a quantum algorithm that can factor large numbers efficiently. On a large, stable quantum computer it would break the most widely used public-key systems, such as RSA and elliptic-curve cryptography.

What is the ‘harvest now, decrypt later’ threat?

Attackers can collect encrypted data today and decrypt it later, once quantum computers are powerful enough. Data that must remain confidential for many years is therefore already at risk.

This mainly threatens information that must remain confidential for a long time, such as:

• State and defence secrets with confidentiality periods of decades.
• Intellectual property of companies, such as trade secrets and research data.
• Sensitive personal data, such as medical and biometric data.
• Financial and legal records that must be kept secure for legal and regulatory reasons.

How is the Netherlands preparing for quantum technology?

The Netherlands invests in quantum technology through a national programme and has published practical guidance for the migration to post-quantum cryptography. Specific Dutch legislation on quantum computing does not exist.

The national programme Quantum Delta NL brings together government, universities and companies. It builds on the National Agenda for Quantum Technology of 2019 and receives funding from, among others, the National Growth Fund (Nationaal Groeifonds). The programme covers quantum computing, quantum networks and quantum sensing, and pays attention to the social and ethical aspects of the technology. These are policy choices, not rules of law that bind companies.

What is being done about post-quantum cryptography?

The Dutch government has published a PQC migration handbook, and organisations are advised to start preparing now. The transition takes years, so waiting increases the risk.

In 2023 the General Intelligence and Security Service (AIVD), research organisation TNO and the Centrum Wiskunde & Informatica (CWI) published a PQC migration handbook. It gives organisations practical steps to prepare for the transition, starting with an inventory of the cryptography they use.

The message is that the move to PQC is not a distant, theoretical problem, but a task that organisations must plan now because it takes years. This fits with the European NIS2 Directive, which requires higher cybersecurity standards for essential and important entities and has been implemented in the Netherlands by the Cybersecurity Act. Organisations that fall under that act must assess their risks, including the risks to their cryptography.

Which European rules shape quantum data security?

The GDPR, the NIS2 Directive, DORA and the Cyber Resilience Act all require security that matches the risks and the state of the art. Together with the EU roadmap for PQC, they push organisations towards quantum-safe encryption.

How does the GDPR apply in a quantum world?

The GDPR does not mention quantum computing, but it is technology-neutral. The duty to take appropriate security measures that reflect the state of the art also covers the quantum risk.

Two provisions are central. Article 25 of the GDPR requires data protection by design and by default: organisations must build technical safeguards for personal data into new processes from the start. Article 32 of the GDPR requires appropriate technical and organisational measures, taking into account the state of the art, the costs and the risks. As post-quantum standards mature, ‘state of the art’ will increasingly mean using quantum-safe encryption for personal data that must remain confidential for a long time. An organisation that does not plan for this transition runs the risk that its security will no longer be considered adequate. Read more about these principles in our guide to the General Data Protection Regulation.

If insufficient security leads to a data breach, the organisation may have to report it to the Dutch Data Protection Authority within 72 hours (Article 33 of the GDPR). The authority can impose fines of up to €20 million or 4% of worldwide annual turnover, and affected persons can claim damages under Article 82 of the GDPR.

Which new EU rules push organisations towards quantum readiness?

The NIS2 Directive, DORA and the Cyber Resilience Act impose broader cybersecurity duties. None of them prescribes specific quantum-safe algorithms, but all require risk-based security that takes account of the state of the art.

Next to the GDPR, three EU instruments strengthen cybersecurity obligations without naming quantum-safe standards:

• The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847): this regulation sets cybersecurity requirements for products with digital elements, such as connected devices and software. Manufacturers must build security into their products and handle vulnerabilities. The reporting obligations apply from 11 September 2026 and most other obligations from 11 December 2027. The CRA does not prescribe quantum-safe encryption, but it does require security appropriate to the risks.
• The NIS2 Directive: this directive extends cybersecurity duties to a wide range of essential and important entities, such as energy, health care and digital infrastructure. It requires risk management, including policies on cryptography and encryption (Article 21), and the reporting of significant incidents. In the Netherlands it is implemented by the Cybersecurity Act.
• DORA: since 17 January 2025, financial entities must have an ICT risk management framework that includes policies on encryption and cryptographic controls, and must manage the risks of their ICT suppliers.

These rules show a clear direction. The move to quantum-safe encryption is not yet an explicit legal requirement, but for organisations with long-term confidential data it follows increasingly from the general duty to take appropriate, state-of-the-art measures.

How do current and expected compliance standards compare?

The table compares the current approach with what is likely to be expected once post-quantum standards are established. The right-hand column describes expected developments, not current law.

What is the European approach to quantum-safe security?

The EU coordinates the transition to PQC with a Commission Recommendation of 11 April 2024 and a roadmap of June 2025. The roadmap aims to protect high-risk systems by 2030 at the latest.

To prevent a fragmented approach, the EU works on a coordinated transition. On 11 April 2024 the European Commission adopted a Recommendation on a Coordinated Implementation Roadmap for the transition to post-quantum cryptography. On that basis, the Member States, supported by the Commission, published a roadmap on 23 June 2025. It provides that Member States start the transition by the end of 2026, that high-risk systems, such as critical infrastructure, are protected with PQC by the end of 2030 at the latest, and that as many systems as practically feasible follow by 2035.

The roadmap is a political commitment, not a binding law. But it shows what regulators and supervisory authorities will expect, and it is likely to influence how the open standards in the GDPR, NIS2 and DORA are interpreted.

In July 2025 the Commission also adopted a Quantum Europe Strategy, and its work programme for 2026 announces a legislative proposal for a Quantum Act. At the time of writing, such an act is not EU law; check the current status before relying on it.

How do you prepare for quantum-safe compliance?

Start with an inventory of your cryptography, then assess which data and systems are most at risk, and migrate in phases. The aim is crypto-agility: being able to replace algorithms quickly.

The goal is crypto-agility: the ability to replace your cryptographic methods quickly when new threats or standards emerge. The process starts with one question: where are you most vulnerable? Use the requirements of the GDPR and, where applicable, NIS2 and DORA as your framework.

Phase 1: how do you make a cryptographic inventory?

You map all cryptography your organisation uses, including in software and devices from suppliers. Without that overview, you cannot set priorities.

Look beyond your main servers. The inventory should cover:

• Data in transit: how are your e-mail, VPN and cloud connections secured?
• Data at rest: which encryption protects your databases, backups and laptops?
• Embedded systems: cryptography in third-party software, connected devices and network equipment.
• Legacy systems: old applications often contain outdated and vulnerable encryption.

Also check your contracts. Agreements with IT suppliers and cloud providers should oblige them to provide information about the cryptography they use, to support updates and to cooperate with a migration. Under Article 28 of the GDPR, a processor must also offer sufficient guarantees for appropriate security.

Phase 2: how do you assess risks and set priorities?

Assess your systems by the sensitivity of the data and by how long it must remain confidential. Data that must be protected for more than ten years comes first.

Use these questions to set priorities:

1. Which data must remain confidential for more than ten years? Think of intellectual property, long-term financial records and sensitive personal data. This is the main target of ‘harvest now, decrypt later’ attacks.
2. Which systems are most exposed to external threats? Public-facing applications and data transfer protocols are on the front line.
3. What are your legal and contractual duties? The GDPR, sector rules and client agreements determine which security level you must meet for certain data, and for how long you must keep it.

Phase 3: how do you migrate to post-quantum cryptography?

You replace vulnerable algorithms in phases, starting with the highest risks, and test carefully. Where possible, combine classical and post-quantum methods during the transition.

With clear priorities, you can start the phased migration to post-quantum cryptography (PQC). This is not a simple replacement. It requires planning, testing and careful implementation, so that business operations are not disrupted. A common approach during the transition is a hybrid solution in which classical and post-quantum methods are used together.

Record your choices, the risk assessment and the planning. If a regulator or a court later asks whether your security was adequate, that documentation is your evidence.

Which legal questions remain open?

Besides encryption, quantum technology raises questions about liability, intellectual property, privacy and export control. Some of these can be answered under existing law; others will be for the courts and the legislator.

One of the main questions is liability. If a company suffers a data breach because its encryption was outdated, who is responsible? Under Dutch law, the answer starts with existing rules. Towards the persons whose data was affected, the organisation is responsible under the GDPR and may have to pay damages (Article 82 of the GDPR). Towards clients, it may be liable for failure to perform a contract (Article 6:74 of the Dutch Civil Code). Whether it can recover the damage from a software supplier that did not provide quantum-safe updates depends on the contract and on what could reasonably be expected at the time. Courts will have to work out how ‘state of the art’ develops over time.

Who owns inventions made with quantum computers?

Under current patent law, only a natural person can be named as inventor. An invention developed with the help of a quantum computer can be patented, but the inventor must be a human.

Quantum computers may help to design molecules, materials and algorithms that cannot be designed today. That raises the question of who owns such inventions. The Legal Board of Appeal of the European Patent Office decided in 2021 (case J 8/20) that an inventor named in a patent application must be a natural person, not a machine. Inventions made with computer tools can still be patented, with the human who directed the work as inventor. Contracts should state clearly who owns results created with quantum computing services, especially when you use the computing capacity of a third party.

Quantum computing may also increase the ability to analyse large amounts of data. The GDPR principles of purpose limitation, data minimisation and proportionality apply fully to such analyses, and a data protection impact assessment (Article 35 GDPR) is required where processing is likely to result in a high risk for individuals.

Which export and investment rules apply to quantum technology?

Certain quantum items are dual-use goods under EU export control rules. Investments in Dutch companies active in quantum technology can be subject to a security screening under the Wet Vifo.

Quantum technology is strategically sensitive. The EU Dual-Use Regulation (Regulation (EU) 2021/821) and national measures can require a licence for the export of certain quantum computers, components and related software and technology. The lists change regularly, so check the current version before you export or share technology with parties outside the EU.

In the Netherlands, the Investments, Mergers and Acquisitions Security Screening Act (Wet veiligheidstoets investeringen, fusies en overnames, Wet Vifo) has applied since 1 June 2023. Acquisitions of, and certain investments in, companies active in sensitive technology, which can include quantum items on the dual-use lists, must be notified to the Investment Screening Bureau (Bureau Toetsing Investeringen, BTI) and may not be completed before approval. Start-ups and investors in quantum technology should therefore check at an early stage whether a transaction is subject to notification.

What should you check as an organisation that holds sensitive data?

Under Article 32 GDPR and, where it applies, the Cybersecurity Act, you remain responsible for the security of your data, also when suppliers run your systems. Check these points:

• Identify data that must remain confidential for more than ten years, such as personnel files, medical data and trade secrets.
• Check whether your organisation falls under the Cybersecurity Act or DORA, and whether the management body has approved the risk measures.
• Ask your IT and cloud suppliers in writing which cryptography they use and when they will support post-quantum methods.
• Check that your data processing agreements under Article 28 GDPR oblige processors to update their security to the state of the art.
• Record your inventory, risk assessment and migration planning, so you can show a regulator or court what you did.

What should you check as a supplier of software or devices?

Your clients will pass their security duties on to you by contract, and the Cyber Resilience Act adds direct product duties from 11 September 2026. Check these points:

• Check whether your products with digital elements fall under the CRA and which obligations apply from 11 September 2026 and 11 December 2027.
• Review the security, update and liability clauses in your client contracts and general terms.
• Define the support period during which you deliver security updates, including cryptographic updates.
• Check whether your quantum hardware, software or technology requires an export licence under Regulation (EU) 2021/821.
• Check whether an investment in your company must be notified to the BTI under the Wet Vifo.

What can we do for you with quantum-related data security?

Our IT lawyers advise businesses on data protection, cybersecurity obligations and contracts with IT suppliers:

• We assess whether your organisation falls under the Cybersecurity Act, DORA or the CRA, and what that requires of you.
• We review and draft security, update and liability clauses in IT, cloud and data processing agreements.
• We help you document your risk assessment and migration plan so that it stands up to a regulator.
• We advise on the data breach notification to the Dutch Data Protection Authority within the 72-hour deadline.
• We check whether a transaction must be notified under the Wet Vifo or an export requires a licence.

Summary

• No law regulates quantum computing as such; the GDPR, the Cybersecurity Act (NIS2) and DORA require security that matches the state of the art and the risks.
• ‘Harvest now, decrypt later’ means that data with a long confidentiality period is already at risk.
• The EU roadmap of June 2025 expects high-risk systems to use post-quantum cryptography by the end of 2030 at the latest; it is a political commitment, not binding law.
• Start with a cryptographic inventory, prioritise by sensitivity and retention period, and migrate in phases with crypto-agility as the goal.
• Quantum technology is also subject to export control and, for investments in Dutch companies, possibly to screening under the Wet Vifo.

Frequently asked questions