Reputational damage often costs a company more than the fine that caused it, and in the Netherlands that is not an accident of the news cycle: it is built into the law. Supervisory authorities are required to publish their enforcement decisions by name, and separate rules oblige organisations to announce their own failures, from data breaches to serious cyber incidents. The fine is a finite, budgeted amount. The publication is what customers, banks, insurers and tender committees actually read. This article sets out where the duty to publish comes from, what you can do about it before it happens, and what remedies exist when what is said about you goes beyond the facts.
Why the publication, not the fine, is the real sanction
A financial penalty is a closed matter once it is paid. A published enforcement decision is not: it stays online, it is indexed, and it is found by anyone who looks. That is deliberate. Publication is used as an instrument of supervision in its own right, on the theory that markets correct behaviour faster than fines do. Lawyers call it naming and shaming; the effect on the business is a second sanction that nobody quantified in advance.
The consequences follow a predictable order. Customers react first and most loudly. Employees follow, because a damaged employer is a problem on their own curriculum vitae. Then come the counterparties: banks reprice or withdraw facilities, insurers ask questions at renewal, suppliers reconsider, and procurement departments apply exclusion criteria that a published sanction can trigger directly. Investors and lenders arrive last but hit hardest, because a public compliance failure is priced as a risk, not as an incident.
None of this is captured by the amount on the penalty notice. That mismatch is the whole of the problem, and it is why the response to an enforcement decision has to be planned as a legal and a communications exercise at the same time, from the first letter rather than after the decision lands.
The knock-on effects that have a legal basis
It is tempting to treat the fallout as a matter of sentiment. Much of it is not. A published sanction feeds directly into legal mechanisms that operate whether or not anyone is angry about it.
Public procurement is the clearest example. Under the Public Procurement Act 2012 a contracting authority must exclude a tenderer in cases of certain criminal convictions, and may exclude one that has committed grave professional misconduct calling its integrity into question, or that has shown significant or persistent shortcomings in an earlier public contract. A published enforcement decision is precisely the kind of document that triggers the assessment. The Act also allows the tenderer to demonstrate that it has taken remedial measures, which is why the concrete steps you take after an incident, and the record of them, have direct commercial value.
Licensing works in a comparable way. Under the Public Administration Probity in Decision-Making Act (Wet Bibob) a public body may investigate the integrity of an applicant before granting a permit, a subsidy or a contract, and may refuse or withdraw it where there is a serious risk that it will be used improperly. Published sanctions and convictions are part of the material used in that assessment.
Private contracts do the rest. Facility agreements contain representations about compliance and events of default; commercial contracts contain termination rights tied to reputational harm or to loss of a licence; share purchase agreements contain warranties about regulatory compliance whose breach becomes a claim. Directors and officers insurance and cyber policies contain notification duties with short deadlines, and late notice is one of the commonest reasons for a claim to be declined. Reading those clauses in the week the decision is published is a week too late; they should be mapped before anything happens.
Dutch regulators are obliged to publish
The starting point is the Open Government Act (Wet open overheid, Woo), in force since 1 May 2022. Article 3.1 of that Act requires public bodies to make information public of their own motion wherever possible, and enforcement decisions fall squarely within it. Publication is the default; confidentiality is the exception that has to be argued.
Several supervisors have a specific statutory duty on top of that. Under article 1:97 of the Financial Supervision Act (Wet op het financieel toezicht) the Authority for the Financial Markets and De Nederlandsche Bank publish decisions imposing an administrative fine, and article 1:98 governs publication once a decision has become irrevocable. Under article 12u of the Instellingswet Autoriteit Consument en Markt the Netherlands Authority for Consumers and Markets publishes its sanction decisions. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) publishes its decisions as well, and inspectorates in the food, healthcare and labour fields publish inspection results as a matter of course.
Two features of this system are worth understanding before you are in it. First, publication normally includes the name of the undertaking; anonymisation is possible but has to be justified, usually on the ground that identification would be disproportionate or would harm an ongoing investigation. Second, publication is not confined to fines. Decisions ordering compliance, and in some cases decisions not to impose a fine at all, are published too. An organisation that settles quietly in the expectation of avoiding publicity is often mistaken about what it has bought. Our article on the administrative fine in the Netherlands sets out how the underlying sanction procedure works.
What you can do before the decision is published
It helps to know where in the procedure you are. A sanction file usually runs from an inspection or investigation, through a report of findings, to a draft decision on which the party concerned may state its view, and then to the decision itself. Objection to the authority follows, then appeal to the administrative court and, in most fields, a further appeal. Publication is a separate track running alongside that one, and it frequently arrives before the substantive dispute is anywhere near finished. Treating the two as one process is the mistake that costs the most.
This is the part of the process that most organisations discover too late, and it is where a lawyer earns their fee. The decision to publish is itself a decision that can be challenged. It is not an inevitable consequence of the sanction.
Under article 3.1 paragraph 3 of the Woo the authority must first tell the party concerned what it intends to publish and give it the opportunity to state its view. That notification, which sets out where, how and when publication will take place, is treated as a decision in its own right. Objection is therefore open against it, and alongside the objection an application can be made to the administrative court under article 8:81 of the General Administrative Law Act (Algemene wet bestuursrecht) for interim relief suspending publication until the objection has been decided.
The window is short, so the sequence matters more than the arguments:
- Use the zienswijze. This is the moment to correct factual errors in the draft text, to point out that the description of the conduct goes further than the findings support, and to argue for anonymisation or for parts to be left out. Corrections obtained here are permanent; corrections attempted afterwards are not.
- Object in time and ask for suspension. An objection alone does not stop publication. The application for interim relief under article 8:81 Awb is what does, and it must be filed within the period the authority has stated it will wait.
- Argue disproportionality, not embarrassment. Courts do not suspend publication because a company would prefer not to be named. They do weigh whether publication is proportionate to the breach, whether the text is factually accurate, whether it would harm third parties such as employees or customers, and whether the decision is still open to challenge on the merits.
- Prepare the response in parallel. Assume publication will go ahead. A short, accurate, non-defensive statement of your own, published the same day, sets the terms on which the decision is read.
One further point is easily missed. If the substantive decision is later annulled, the publication does not disappear by itself. Ask expressly for rectification and for removal, and record that request in writing at the time.
The disclosures you have to make yourself
Regulators are not the only source of unwanted publicity. A series of rules require organisations to announce their own failures, and the timetables are unforgiving.
The best known is the personal data breach. Article 33 of the General Data Protection Regulation requires notification to the Dutch Data Protection Authority without undue delay and, where feasible, within seventy-two hours of becoming aware of the breach. Article 34 goes further: where the breach is likely to result in a high risk to the rights and freedoms of the individuals concerned, they must be told directly and in plain language. That second obligation is what turns an incident into a public event, because an organisation communicating with thousands of customers is communicating with the press.
Since 15 August 2026 the Cybersecurity Act (Cyberbeveiligingswet), which implements the NIS2 Directive, adds a parallel regime for essential and important entities. It requires registration with the National Cyber Security Centre and a two-stage report of significant incidents: an early warning within twenty-four hours and a fuller notification within seventy-two hours. The two regimes overlap but are not the same, and an incident can trigger both. Our article on cybersecurity and liability in the Netherlands deals with the responsibility question that follows.
Listed companies face a third layer. Under article 17 of the Market Abuse Regulation an issuer must disclose inside information as soon as possible; a serious enforcement action or a major breach can qualify. Disclosure may be delayed only on strict conditions and the delay must be documented and justified afterwards. The practical consequence is that the decision about what to say to the market cannot be taken by the communications department alone.
A third route into the public domain is worth knowing about, because you cannot control it and can only influence it. Anyone, including a journalist or a competitor, may request documents held by a public body under the Woo, and inspection reports, correspondence and enforcement files about your organisation are all potentially within scope. Where a request concerns information that affects you, the authority must in principle give you the opportunity to state your view before it decides to release it, and its decision to release is again open to objection and to an application for interim relief. Business confidential information and manufacturing and trade data enjoy protection under the Act, but the protection has to be invoked and substantiated document by document. A blanket assertion that everything is confidential is routinely rejected.
When the reporting about you crosses a line
Accurate reporting of a published enforcement decision is lawful, and no amount of commercial harm makes it unlawful. What is actionable is a publication that states or suggests something untrue, that presents unproven allegations as established fact, or that is needlessly damaging in the way it is framed.
The civil route runs through article 6:162 of the Civil Code. A court weighs the seriousness of the accusation, the degree of support the facts gave it at the time of publication, the way it was presented, the public interest served and the harm caused. Freedom of expression under article 10 of the European Convention on Human Rights sits on one side of that balance and the protection of honour, reputation and private life on the other; neither has automatic priority. Where the publication is incorrect or misleading, article 6:167 of the Civil Code allows the court to order a rectification, which is usually worth more than damages because it addresses the record rather than the loss.
There is a criminal route as well. Smaad and laster, defamation and slander, are offences under articles 261 and 262 of the Criminal Code, and both are complaint offences, which means the prosecution normally starts only if the injured party files a complaint. In commercial disputes this route is rarely the efficient one, but it changes the tone of a negotiation. Our guide on defamation and libel explains where the boundaries run.
Two practical warnings. Interim relief proceedings against a publisher are fast but public, and a claim that fails hands the other side a second story; weigh that before starting. And a claim brought to suppress accurate criticism tends to be recognised as such, both by the court and by the audience you were trying to reach.
Getting information taken down later
Reputational damage has a long tail, and the question that arrives eighteen months after the event is how to get the material off the internet. There is no general right to be forgotten in the sense that people imagine, but there are three real instruments.
The first is the right to erasure under article 17 of the General Data Protection Regulation, which applies to personal data and therefore protects individuals rather than companies. A director named in an old article can rely on it; the company usually cannot.
The second is delisting. A search engine can be asked to remove a result for a search on a person's name, and if it refuses, the Dutch Data Protection Authority or the civil court can be asked to order it. The test is a balancing exercise: the age of the information, the seriousness of the conduct, the person's role in public life and the continuing relevance of the material all count. Delisting does not remove the source; it removes the route most people use to find it.
The third is the publication policy of the courts and the authorities themselves. Judgments are published in anonymised form as a rule, and authorities generally apply their own retention periods to published sanction decisions. Where a decision was annulled or the underlying facts have changed, a reasoned request for removal or for the addition of a note is often granted, and it is almost never made.
There is also the question of how long material stays up. Authorities apply retention periods to what they publish, and a decision does not remain on the website indefinitely; the Financial Supervision Act, for instance, distinguishes between publication of a decision that is not yet irrevocable and publication once it is. That distinction is worth raising in the zienswijze, because a text that makes clear the decision is still open to challenge is read differently from one that does not. Where an old publication is still online after the applicable period has run, a written request usually resolves it, and it is a request that almost nobody makes.
Individual exposure: directors, managers and staff
A social sentence rarely stops at the entity. Three separate exposures deserve naming.
A director can be held personally liable towards the company under article 2:9 of the Civil Code for improper performance of duties, and towards third parties under article 6:162 where a serious personal reproach can be made. In insolvency, a civil-law directors' disqualification is available under the Bankruptcy Act in cases of serious mismanagement, and that disqualification is registered and public.
Employees who raise the alarm are protected. The Whistleblower Protection Act (Wet bescherming klokkenmelders) has applied since 18 February 2023 and requires employers with fifty or more employees to have an internal reporting procedure; reporters are protected against dismissal and other detrimental treatment, and the burden of proving that a disadvantage was unrelated to the report lies with the employer. An organisation that responds to a report by attacking the reporter converts a compliance problem into a labour dispute and a second news story.
Finally, an employer that names or blames an individual employee in its public communication about an incident is processing personal data and may be breaching its duty as a good employer at the same time. The instinct to explain that one person was responsible is understandable and almost always wrong.
Sustainability claims are the current growth area
Environmental and social claims have become the fastest-growing source of reputational exposure in the Dutch market, and unlike much of what is written about them, the legal position is reasonably clear. A misleading sustainability claim is an unfair commercial practice under articles 6:193a and following of the Civil Code, which implement the EU rules on unfair commercial practices. If the claim is vague, unsubstantiated or true only of a fraction of the product range, it is capable of being misleading, and the burden of substantiating it lies with the trader. The Netherlands Authority for Consumers and Markets has published guidance on sustainability claims and has enforced against companies on this basis; competitors and interest groups also litigate these claims directly.
Climate litigation shows how the reputational and legal tracks diverge. In 2021 the district court in The Hague ordered Shell to reduce the carbon dioxide emissions of its group by a set percentage. On 12 November 2024 the Court of Appeal in The Hague set that order aside, while confirming that the company owes a duty of care in relation to climate change; an appeal in cassation to the Supreme Court is pending. The legal outcome was therefore mixed and is not final, but the public verdict was delivered in 2021 and has not been revised since. That gap between the judgment and the narrative is exactly what the social sentence describes. Our analysis of the ruling in the climate case against Shell sets out the reasoning in full.
Reducing the exposure before anything happens
Prevention in this area is not a matter of culture statements. It is a matter of knowing, before an incident, who decides what and within what deadline.
Four things make the difference. Know which reporting obligations apply to your organisation and what the clock is on each of them, because seventy-two hours is short and twenty-four hours is shorter. Have an internal reporting channel that works and that people trust, both because the Whistleblower Protection Act may require it and because an internal report is the cheapest form of early warning there is. Make sure the first draft of any external statement is read by a lawyer, since a public statement can create liability, can amount to an admission and can conflict with what has been told to a regulator. And decide in advance who speaks, so that the answer is not improvised on the day.
When an incident does occur, the sequence that works is unvarying: contain the problem, establish the facts before commenting on them, meet the statutory notification deadlines, acknowledge what is known without speculating about what is not, and set out concretely what has been changed. Silence reads as concealment and speculation creates a second story; the middle course is narrow but it is the only one that holds.
The social sentence and reputational damage
How is a social sentence different from just bad PR?
While they might seem similar, they're worlds apart. Bad PR is often a single negative event—a rough news cycle that, with time, eventually fades from public memory. A social sentence, on the other hand, is a fundamental shift in public perception. It becomes a permanent part of your brand's story, fundamentally changing how customers, partners, and even your own employees see you for the long haul. You could think of it this way: bad PR is a storm that you weather. A social sentence changes the entire climate. It’s rooted in a deep-seated loss of trust that is far more difficult and complex to repair.
Can a small business really suffer a social sentence?
Absolutely. In fact, small and medium-sized businesses can be even more vulnerable. A large corporation often has the resources to absorb a reputational blow—deep financial reserves, a dedicated PR army, and years of brand recognition to fall back on. An SME, however, usually relies heavily on the trust of its local community and a loyal customer base. For them, a social sentence can be devastating. Losing even a small number of customers or damaging a hard-won local reputation can quickly become an existential threat. The core of a social sentence is a breach of trust. This dynamic is universal and can impact any organisation, regardless of its size or industry. For a local business, the impact can feel even more personal and immediate.
Is it possible to fully recover from a social sentence?
It's a long road, but yes, recovery is possible—though it's never guaranteed. It demands a sustained, genuine commitment to rebuilding trust that goes far beyond a simple press-release apology. Real recovery means transparently owning the failure, demonstrating accountability through concrete actions, and fundamentally changing the behaviours that led to the crisis in the first place. This isn't a quick fix. The process involves several key steps: Radical Transparency: Openly communicating what went wrong and exactly what you're doing to fix it. No sugarcoating.; Demonstrable Change: Implementing new policies, changing leadership, or overhauling company culture to ensure it can't happen again.; Long-Term Consistency: Proving through your actions, over a long period, that the changes are real and lasting. Words are cheap; consistent, ethical behaviour is what rebuilds trust.
A crisis is unfolding. What's the very first thing I should do?
Acknowledge the problem. Do it swiftly, and do it sincerely. Silence or denial is almost always the worst possible move; people will interpret it as arrogance, guilt, or both, and it will only fuel the fire. Your first statement sets the tone for everything that follows. This initial communication needs to show you're taking responsibility, express empathy for anyone affected, and briefly outline the immediate steps you're taking to investigate and address the issue. Hesitation is your enemy; a quick, honest, and responsible acknowledgement is your best first move in mitigating the ‘social sentence’: when reputational damage hurts more than the fine.
What is meant by the “social sentence”?
It refers to the lasting public verdict a company or individual faces once wrongdoing becomes known, on top of any official fine. In the Netherlands that verdict is often set in motion by the authority itself, because enforcement decisions are published by name under the Open Government Act and under sector legislation such as the Financial Supervision Act and the Instellingswet ACM. Unlike a financial penalty, which is a one-time, finite cost, the social sentence is an unofficial, ongoing punishment handed down in the court of public opinion.
Why can reputational damage be worse than a financial penalty?
A financial penalty is a quantifiable cost that can be budgeted for and, once paid, is legally closed. Reputational damage is unpredictable and can erode public trust, customer loyalty and brand integrity long after the formal penalty has been settled.
Is there a real example of this in the Netherlands?
Yes, the government’s handling of the child benefit scandal (toeslagenaffaire) between 2013 and 2019 is a notable example, where the reputational damage and loss of public trust in state institutions were considered far more profound than the compensation costs involved.
How do defamation and libel relate to reputational disputes?
These legal concepts are often at the heart of public disputes over reputational harm, since they govern when a statement about a person or company becomes an unlawful act under article 6:162 of the Civil Code, or the criminal offences of smaad and laster under articles 261 and 262 of the Criminal Code. The court weighs freedom of expression against the protection of honour and reputation on the facts of each case, and article 6:167 of the Civil Code allows it to order a rectification.
Law and More advises companies and directors facing enforcement action and the publicity that comes with it: responding to a supervisor before a decision is taken, objecting to publication and applying for interim relief, meeting notification obligations under the GDPR and the Cybersecurity Act, and acting against publications that go beyond the facts. If a decision about your organisation is about to be published, or has been, contact us promptly; the options narrow quickly once it is online.
