Publication of a fine: how do you limit the reputational damage?

In the Netherlands, a fine from a regulator is usually followed by publication of the decision, with your company’s name. You can influence that publication before it happens, by giving your view and, if needed, asking the court to suspend it, but once it is online, accurate reporting about it is lawful and hard to undo.

That is why the publication often hurts more than the fine. The fine is a fixed, budgeted amount. The published decision is what customers, banks, insurers and tender committees read.

Why is publication often the real sanction?

A fine is closed once it is paid. A published enforcement decision stays online, is indexed by search engines and is found by anyone who looks for your company.

This is deliberate. Dutch law uses publication as an instrument of supervision in its own right, on the idea that the market corrects behaviour faster than a fine does. For the business, it works as a second sanction.

The response to an enforcement procedure should be planned as a legal and a communications exercise at the same time, starting with the first letter from the regulator, not after the decision is published.

Which consequences have a legal basis?

Public procurement is the clearest example. Under the Public Procurement Act 2012 (Aanbestedingswet 2012), a contracting authority must exclude a tenderer that has been convicted of certain offences. It may exclude a tenderer that has committed grave professional misconduct which calls its integrity into question, or that has shown significant or persistent shortcomings in an earlier public contract. A published enforcement decision is exactly the kind of document that triggers that assessment.

The Act also allows a tenderer to show that it has taken remedial measures, often called self-cleaning. The concrete steps you take after an incident, and the written record of those steps, therefore have direct commercial value in later tenders.

Permits work in a comparable way. Under the Public Administration Probity Screening Act (Wet Bibob), a public body may investigate the integrity of an applicant before granting a permit, subsidy or contract. It may refuse or withdraw it if there is a serious risk that it will be misused. Published sanctions and convictions are part of the material used in that assessment.

Private contracts do the rest. Loan agreements contain compliance representations and events of default. Commercial contracts contain termination rights tied to reputational harm or loss of a licence. Share purchase agreements contain warranties on regulatory compliance. Directors’ and officers’ insurance and cyber policies contain notification duties with short deadlines, and late notice is a common reason for cover to be refused. Map those clauses before anything happens, not in the week the decision is published.

Are Dutch regulators obliged to publish their decisions?

Yes, in most cases. Under the Open Government Act (Wet open overheid, Woo), public bodies must disclose information of their own motion where possible, and several regulators have a specific statutory duty to publish their sanction decisions.

The Woo has applied since 1 May 2022. Article 3.1 of the Act sets the general duty of active disclosure. For enforcement decisions this means that publication is the starting point and confidentiality is the exception that has to be argued. You can read the Act on wetten.overheid.nl.

Several regulators have their own publication rules on top of that. Under Article 1:97 of the Financial Supervision Act (Wet op het financieel toezicht, Wft), the Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) publish decisions imposing an administrative fine. The Netherlands Authority for Consumers and Markets (ACM) publishes its sanction decisions under its own Establishment Act (Instellingswet ACM). The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) publishes its decisions as well, and inspectorates in the food, healthcare and labour fields regularly publish inspection results.

Two features of this system are worth knowing before you are in it. First, publication normally includes the name of the company. Anonymisation is possible, but must be justified, for example because naming would be disproportionate or would harm an ongoing investigation. Second, publication is not limited to fines. Orders to comply and other enforcement decisions can be published too. A company that settles quietly to avoid publicity may be mistaken about what it has achieved.

Our article on the administrative fine in the Netherlands explains how the underlying sanction procedure works.

What can you do before the decision is published?

Use your right to give your view (zienswijze) on the intended publication, and object to the decision to publish if necessary. An objection alone does not stop publication; for that you need interim relief from the administrative court.

It helps to know where you are in the procedure. A sanction file usually starts with an inspection or investigation. The regulator then drafts a report of findings and an intended decision, on which you may give your view. Then follows the decision itself. After that you can object to the regulator, appeal to the administrative court and, in most fields, lodge a further appeal.

Publication runs on a separate track alongside that procedure. It often takes place long before the dispute about the fine itself is over. Treating the two tracks as one process is the mistake that costs companies the most.

Challenging the decision to publish

The decision to publish is not an automatic consequence of the fine. Regulators generally announce in advance what they intend to publish, where and when, and give you the opportunity to respond. The decision to publish is in most cases itself a decision (besluit) under the General Administrative Law Act (Algemene wet bestuursrecht, Awb). You can object to it.

At the same time as your objection, you can ask the preliminary relief judge (voorzieningenrechter) of the administrative court to suspend publication under Article 8:81 Awb until the objection has been decided. The period between the announcement and publication is short. The order of your steps therefore matters as much as the arguments.

• Use your zienswijze. This is the moment to correct factual errors, to point out where the description goes further than the findings support, and to argue for anonymisation or for leaving parts out. Corrections obtained at this stage are permanent.
• Object in time and ask for suspension. Only an application for interim relief under Article 8:81 Awb can stop publication. File it within the period the regulator has said it will wait.
• Argue disproportionality, not embarrassment. Courts do not suspend publication because a company would prefer not to be named. They do weigh whether publication is proportionate to the breach, whether the text is accurate, whether it harms third parties such as employees or customers, and whether the decision can still be challenged.
• Prepare your own statement in parallel. Assume publication will go ahead. A short, accurate and calm statement published the same day sets the terms on which the decision is read.

One further point is easily missed. If the fine is later annulled, the publication does not disappear by itself. Ask the regulator in writing for a correction or removal, and keep a record of that request.

Which disclosures must you make yourself?

Several rules require organisations to report their own incidents, often within 24 or 72 hours. A data breach, a significant cyber incident or inside information for a listed company can each trigger a duty that puts the matter in the public domain.

Personal data breaches

Under Article 33 of the General Data Protection Regulation (GDPR), you must report a personal data breach to the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. That is not required if the breach is unlikely to result in a risk to the people concerned.

Article 34 GDPR goes further. If the breach is likely to result in a high risk to the rights and freedoms of the people concerned, you must inform them directly and in plain language. That second duty is what turns an incident into a public event: a message to thousands of customers will also reach the press. Breach of these notification duties can lead to a fine of up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher.

Significant cyber incidents

Since 15 August 2026, the Cybersecurity Act (Cyberbeveiligingswet), which implements the European NIS2 Directive, applies to essential and important entities. In-scope organisations must register and report significant incidents in stages: an early warning within 24 hours and a fuller notification within 72 hours of becoming aware of the incident.

The GDPR and the Cybersecurity Act overlap but are not the same, and one incident can trigger both. Our article on cybersecurity and liability in the Netherlands deals with the question of who is responsible after a breach.

Inside information for listed companies

Listed companies have a third layer. Under Article 17 of the Market Abuse Regulation (MAR), an issuer must disclose inside information as soon as possible. A serious enforcement action or a major incident can qualify. Disclosure may be delayed only under strict conditions, and the AFM must be informed of the delay once the information is published. The decision on what to tell the market can therefore not be left to the communications department alone.

Requests under the Open Government Act

A further route into the public domain is one you cannot control, only influence. Anyone, including a journalist or a competitor, may ask a public body for documents under the Woo. Inspection reports, correspondence and enforcement files about your organisation can all fall within such a request.

If a request concerns information that affects you, the public body must in principle give you the opportunity to give your view before it decides to release it. The decision to release is again open to objection and to an application for interim relief. Confidential business information and trade data are protected, but you must invoke and substantiate that protection document by document. A general claim that everything is confidential will usually be rejected.

What can you do when reporting about you crosses a line?

Accurate reporting about a published enforcement decision is lawful, however much commercial harm it causes. You can act against a publication that states or suggests something untrue, presents unproven allegations as established fact, or is needlessly damaging in the way it is framed.

The civil route: unlawful publication and rectification

The civil route runs through Article 6:162 of the Dutch Civil Code (BW), the general rule on wrongful acts. The court weighs the seriousness of the accusation, the support the facts gave it at the time of publication, the way it was presented, the public interest and the harm caused.

Freedom of expression under Article 10 of the European Convention on Human Rights is on one side of that balance. The protection of honour, reputation and private life is on the other. Neither has automatic priority. If a publication is incorrect or misleading, Article 6:167 BW allows the court to order a rectification. That is often worth more than damages, because it corrects the record rather than compensating the loss.

The criminal route: defamation and slander

Defamation (smaad) and slander (laster) are criminal offences under Articles 261 and 262 of the Dutch Criminal Code (Sr). Both are complaint offences: the Public Prosecution Service (OM) can in principle only prosecute if the injured party files a complaint. In commercial disputes this route is rarely the most efficient one. Our article on defamation and libel explains where the boundaries lie.

Two practical warnings

Summary proceedings (kort geding) against a publisher are fast but public. A claim that fails gives the other side a second story, so weigh that before you start. A claim that seeks to suppress accurate criticism also tends to be recognised as such, both by the court and by the audience you are trying to reach.

How can you get information taken down later?

There is no general right to be forgotten, but three instruments can help: the right to erasure for individuals, delisting by search engines, and a request to the regulator to remove or update its own publication.

Erasure and delisting

The right to erasure under Article 17 GDPR applies to personal data. It protects individuals, not companies. A director named in an old article can rely on it; the company itself usually cannot.

A search engine can be asked to remove a result that appears when someone searches on a person’s name. If it refuses, you can turn to the Dutch Data Protection Authority or the civil court. The test is a balancing exercise: the age of the information, the seriousness of the conduct, the person’s role in public life and the continuing relevance of the material all count. Delisting does not remove the source, but it removes the route most people use to find it.

Removal by the regulator

Regulators generally apply their own retention periods to published sanction decisions. A decision does not stay on their website indefinitely. Court judgments are published in anonymised form as a rule.

If a decision was annulled, or the facts have changed, a reasoned request for removal or for an added note is often successful. The same applies when an old publication is still online after the regulator’s retention period has ended. It also helps to ask, in your zienswijze, that the publication states clearly whether the decision is still open to challenge. A text that makes that clear is read differently.

Are directors and employees personally exposed?

Yes. The consequences of an incident rarely stop at the company. Directors can be held personally liable, whistleblowers are protected, and naming an individual employee in public can itself be unlawful.

A director can be held personally liable towards the company under Article 2:9 BW for improper performance of duties. Towards third parties, liability under Article 6:162 BW requires that a serious personal reproach can be made. In bankruptcy, the court can impose a civil-law director disqualification (civielrechtelijk bestuursverbod) in cases of serious mismanagement. That disqualification is registered and public.

Employees who report wrongdoing are protected. The Whistleblower Protection Act (Wet bescherming klokkenmelders) has applied since 18 February 2023. Employers with 50 or more employees must have an internal reporting procedure. Reporters are protected against dismissal and other detrimental treatment, and if a reporter is disadvantaged, the employer must prove that the disadvantage is unrelated to the report.

Finally, an employer that names or blames an individual employee in its public statements about an incident is processing personal data. It may also be breaching its duty to act as a good employer (Article 7:611 BW).

Why are sustainability claims a growing risk?

A misleading environmental or social claim is an unfair commercial practice under Articles 6:193a and following BW, and the burden of proving the claim lies with the company. The ACM enforces these rules, and competitors and interest groups also take companies to court over them.

A claim that is vague, not substantiated or true for only part of the product range can be misleading. The ACM has published guidance on sustainability claims and has taken action against companies on this basis. Because these cases attract media attention, a finding against you tends to become public quickly.

Climate litigation shows how the legal and the reputational track can diverge. In 2021 the district court in The Hague ordered Shell to reduce the carbon dioxide emissions of its group by a set percentage. On 12 November 2024 the Court of Appeal in The Hague set that order aside, while confirming that the company owes a duty of care in relation to climate change. Milieudefensie then lodged an appeal in cassation with the Supreme Court (Hoge Raad).

The public verdict was formed in 2021, before the legal outcome was known. Our analysis of the ruling in the climate case against Shell sets out the reasoning.

What should you check as a company?

Know in advance who decides what, and within which deadline. The GDPR gives you 72 hours to report a data breach, and the Cybersecurity Act 24 hours for an early warning.

• Which reporting duties apply to you (GDPR, Cybersecurity Act, MAR) and the deadline for each.
• Whether your internal reporting channel meets the Whistleblower Protection Act, mandatory from 50 employees.
• Which loan, insurance and commercial contracts contain notification duties or termination rights tied to sanctions.
• Whether you have used your zienswijze and noted the date the regulator will publish.
• Whether a lawyer has read the first draft of any external statement, and who speaks for the organisation.
• Whether remedial measures are documented, so you can rely on self-cleaning in later tenders.

What should you check as a director?

As a director, your own exposure runs alongside the company’s. Liability towards the company follows from Article 2:9 BW, towards third parties from Article 6:162 BW.

• Whether decisions around the incident and their reasoning are recorded in board minutes.
• Whether your D&O insurer has been notified within the policy deadline.
• Whether you are named in a publication, and whether you can ask for erasure or delisting under Article 17 GDPR.
• Whether public statements avoid naming or blaming individual employees (Article 7:611 BW).

What can we do for you with publication of a fine?

Our lawyers advise companies and directors facing enforcement action and the publicity that comes with it.

• We draft your zienswijze on the intended publication, aimed at factual corrections and anonymisation.
• We file the objection and apply for interim relief under Article 8:81 Awb before the publication date.
• We assess your reporting duties after a data breach or cyber incident and the deadlines that run.
• We protect your business information in Woo requests, document by document.
• We demand rectification under Article 6:167 BW, or removal of an outdated publication by the regulator.

Summary

• Dutch regulators publish most sanction decisions by name, under the Open Government Act and sector rules such as the Financial Supervision Act.
• You can give your view on an intended publication, object to the decision to publish and ask the court for interim relief under Article 8:81 Awb.
• Data breaches, significant cyber incidents and inside information each come with their own reporting duties, often within 24 or 72 hours.
• Against inaccurate reporting you can seek rectification under Article 6:167 BW; accurate reporting is lawful.
• Prepare in advance: know your deadlines, your contracts and who speaks for the organisation.

Frequently asked questions