In the Netherlands, a fine from a regulator is usually followed by publication of the decision, with your company’s name. You can influence that publication before it happens, by giving your view and, if needed, asking the court to suspend it, but once it is online, accurate reporting about it is lawful and hard to undo.
That is why the publication often hurts more than the fine. The fine is a fixed, budgeted amount. The published decision is what customers, banks, insurers and tender committees read. Below we explain where the duty to publish comes from, what you can do before publication, which disclosures you must make yourself, and which remedies exist when reporting goes beyond the facts.
Why is publication often the real sanction?
A fine is closed once it is paid. A published enforcement decision stays online, is indexed by search engines and is found by anyone who looks for your company.
This is deliberate. Dutch law uses publication as an instrument of supervision in its own right, on the idea that the market corrects behaviour faster than a fine does. This is sometimes called naming and shaming. For the business, it works as a second sanction that nobody calculated in advance.
The effects tend to follow a pattern. Customers react first. Employees follow, because a damaged employer also affects their own career. Then the business partners react: banks review their facilities, insurers ask questions at renewal, suppliers reconsider, and procurement departments apply their exclusion criteria. Investors and lenders often come last but weigh heaviest, because a public compliance failure is priced as a risk, not as an incident.
None of this is reflected in the amount of the fine. That is why the response to an enforcement procedure should be planned as a legal and a communications exercise at the same time, starting with the first letter from the regulator, not after the decision is published.
Which consequences have a legal basis?
Much of the fallout is not a matter of sentiment. A published sanction feeds into legal mechanisms that apply whether or not anyone is angry.
Public procurement is the clearest example. Under the Public Procurement Act 2012 (Aanbestedingswet 2012), a contracting authority must exclude a tenderer that has been convicted of certain offences. It may exclude a tenderer that has committed grave professional misconduct which calls its integrity into question, or that has shown significant or persistent shortcomings in an earlier public contract. A published enforcement decision is exactly the kind of document that triggers that assessment.
The Act also allows a tenderer to show that it has taken remedial measures, often called self-cleaning. The concrete steps you take after an incident, and the written record of those steps, therefore have direct commercial value in later tenders.
Permits work in a comparable way. Under the Public Administration Probity Screening Act (Wet Bibob), a public body may investigate the integrity of an applicant before granting a permit, subsidy or contract. It may refuse or withdraw it if there is a serious risk that it will be misused. Published sanctions and convictions are part of the material used in that assessment.
Private contracts do the rest. Loan agreements contain compliance representations and events of default. Commercial contracts contain termination rights tied to reputational harm or loss of a licence. Share purchase agreements contain warranties on regulatory compliance. Directors’ and officers’ insurance and cyber policies contain notification duties with short deadlines, and late notice is a common reason for cover to be refused. Map those clauses before anything happens, not in the week the decision is published.
Are Dutch regulators obliged to publish their decisions?
Yes, in most cases. Under the Open Government Act (Wet open overheid, Woo), public bodies must disclose information of their own motion where possible, and several regulators have a specific statutory duty to publish their sanction decisions.
The Woo has applied since 1 May 2022. Article 3.1 of the Act sets the general duty of active disclosure. For enforcement decisions this means that publication is the starting point and confidentiality is the exception that has to be argued. You can read the Act on wetten.overheid.nl.
Several regulators have their own publication rules on top of that. Under Article 1:97 of the Financial Supervision Act (Wet op het financieel toezicht, Wft), the Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) publish decisions imposing an administrative fine. The Netherlands Authority for Consumers and Markets (ACM) publishes its sanction decisions under its own Establishment Act (Instellingswet ACM). The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) publishes its decisions as well, and inspectorates in the food, healthcare and labour fields regularly publish inspection results.
Two features of this system are worth knowing before you are in it. First, publication normally includes the name of the company. Anonymisation is possible, but must be justified, for example because naming would be disproportionate or would harm an ongoing investigation. Second, publication is not limited to fines. Orders to comply and other enforcement decisions can be published too. A company that settles quietly to avoid publicity may be mistaken about what it has achieved.
Our article on the administrative fine in the Netherlands explains how the underlying sanction procedure works.
What can you do before the decision is published?
Use your right to give your view (zienswijze) on the intended publication, and object to the decision to publish if necessary. An objection alone does not stop publication; for that you need interim relief from the administrative court.
It helps to know where you are in the procedure. A sanction file usually starts with an inspection or investigation. The regulator then drafts a report of findings and an intended decision, on which you may give your view. Then follows the decision itself. After that you can object to the regulator, appeal to the administrative court and, in most fields, lodge a further appeal.
Publication runs on a separate track alongside that procedure. It often takes place long before the dispute about the fine itself is over. Treating the two tracks as one process is the mistake that costs companies the most.
Challenging the decision to publish
The decision to publish is not an automatic consequence of the fine. Regulators generally announce in advance what they intend to publish, where and when, and give you the opportunity to respond. The decision to publish is in most cases itself a decision (besluit) under the General Administrative Law Act (Algemene wet bestuursrecht, Awb). You can object to it.
At the same time as your objection, you can ask the preliminary relief judge (voorzieningenrechter) of the administrative court to suspend publication under Article 8:81 Awb until the objection has been decided. The period between the announcement and publication is short. The order of your steps therefore matters as much as the arguments.
- Use your zienswijze. This is the moment to correct factual errors, to point out where the description goes further than the findings support, and to argue for anonymisation or for leaving parts out. Corrections obtained at this stage are permanent.
- Object in time and ask for suspension. Only an application for interim relief under Article 8:81 Awb can stop publication. File it within the period the regulator has said it will wait.
- Argue disproportionality, not embarrassment. Courts do not suspend publication because a company would prefer not to be named. They do weigh whether publication is proportionate to the breach, whether the text is accurate, whether it harms third parties such as employees or customers, and whether the decision can still be challenged.
- Prepare your own statement in parallel. Assume publication will go ahead. A short, accurate and calm statement published the same day sets the terms on which the decision is read.
One further point is easily missed. If the fine is later annulled, the publication does not disappear by itself. Ask the regulator in writing for a correction or removal, and keep a record of that request.
Which disclosures must you make yourself?
Several rules require organisations to report their own incidents, often within 24 or 72 hours. A data breach, a significant cyber incident or inside information for a listed company can each trigger a duty that puts the matter in the public domain.
Personal data breaches
Under Article 33 of the General Data Protection Regulation (GDPR), you must report a personal data breach to the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. That is not required if the breach is unlikely to result in a risk to the people concerned.
Article 34 GDPR goes further. If the breach is likely to result in a high risk to the rights and freedoms of the people concerned, you must inform them directly and in plain language. That second duty is what turns an incident into a public event: a message to thousands of customers will also reach the press. Breach of these notification duties can lead to a fine of up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher.
Significant cyber incidents
Since 15 August 2026, the Cybersecurity Act (Cyberbeveiligingswet), which implements the European NIS2 Directive, applies to essential and important entities. In-scope organisations must register and report significant incidents in stages: an early warning within 24 hours and a fuller notification within 72 hours of becoming aware of the incident.
The GDPR and the Cybersecurity Act overlap but are not the same, and one incident can trigger both. Our article on cybersecurity and liability in the Netherlands deals with the question of who is responsible after a breach.
Inside information for listed companies
Listed companies have a third layer. Under Article 17 of the Market Abuse Regulation (MAR), an issuer must disclose inside information as soon as possible. A serious enforcement action or a major incident can qualify. Disclosure may be delayed only under strict conditions, and the AFM must be informed of the delay once the information is published. The decision on what to tell the market can therefore not be left to the communications department alone.
Requests under the Open Government Act
A further route into the public domain is one you cannot control, only influence. Anyone, including a journalist or a competitor, may ask a public body for documents under the Woo. Inspection reports, correspondence and enforcement files about your organisation can all fall within such a request.
If a request concerns information that affects you, the public body must in principle give you the opportunity to give your view before it decides to release it. The decision to release is again open to objection and to an application for interim relief. Confidential business information and trade data are protected, but you must invoke and substantiate that protection document by document. A general claim that everything is confidential will usually be rejected.
What can you do when reporting about you crosses a line?
Accurate reporting about a published enforcement decision is lawful, however much commercial harm it causes. You can act against a publication that states or suggests something untrue, presents unproven allegations as established fact, or is needlessly damaging in the way it is framed.
The civil route: unlawful publication and rectification
The civil route runs through Article 6:162 of the Dutch Civil Code (BW), the general rule on wrongful acts. The court weighs the seriousness of the accusation, the support the facts gave it at the time of publication, the way it was presented, the public interest and the harm caused.
Freedom of expression under Article 10 of the European Convention on Human Rights is on one side of that balance. The protection of honour, reputation and private life is on the other. Neither has automatic priority. If a publication is incorrect or misleading, Article 6:167 BW allows the court to order a rectification. That is often worth more than damages, because it corrects the record rather than compensating the loss.
The criminal route: defamation and slander
Defamation (smaad) and slander (laster) are criminal offences under Articles 261 and 262 of the Dutch Criminal Code (Sr). Both are complaint offences: the Public Prosecution Service (OM) can in principle only prosecute if the injured party files a complaint. In commercial disputes this route is rarely the most efficient one. Our article on defamation and libel explains where the boundaries lie.
Two practical warnings
Summary proceedings (kort geding) against a publisher are fast but public. A claim that fails gives the other side a second story, so weigh that before you start. A claim that seeks to suppress accurate criticism also tends to be recognised as such, both by the court and by the audience you are trying to reach.
How can you get information taken down later?
There is no general right to be forgotten, but three instruments can help: the right to erasure for individuals, delisting by search engines, and a request to the regulator to remove or update its own publication.
Reputational damage has a long tail. The question that comes up eighteen months after an incident is usually how to get the material off the internet. The answer depends on who is asking and where the information is.
Erasure and delisting
The right to erasure under Article 17 GDPR applies to personal data. It protects individuals, not companies. A director named in an old article can rely on it; the company itself usually cannot.
A search engine can be asked to remove a result that appears when someone searches on a person’s name. If it refuses, you can turn to the Dutch Data Protection Authority or the civil court. The test is a balancing exercise: the age of the information, the seriousness of the conduct, the person’s role in public life and the continuing relevance of the material all count. Delisting does not remove the source, but it removes the route most people use to find it.
Removal by the regulator
Regulators generally apply their own retention periods to published sanction decisions. A decision does not stay on their website indefinitely. Court judgments are published in anonymised form as a rule.
If a decision was annulled, or the facts have changed, a reasoned request for removal or for an added note is often successful. The same applies when an old publication is still online after the regulator’s retention period has ended. Such requests are rarely made, which is a missed opportunity. It also helps to ask, in your zienswijze, that the publication states clearly whether the decision is still open to challenge. A text that makes that clear is read differently.
Are directors and employees personally exposed?
Yes. The consequences of an incident rarely stop at the company. Directors can be held personally liable, whistleblowers are protected, and naming an individual employee in public can itself be unlawful.
A director can be held personally liable towards the company under Article 2:9 BW for improper performance of duties. Towards third parties, liability under Article 6:162 BW requires that a serious personal reproach can be made. In bankruptcy, the court can impose a civil-law director disqualification (civielrechtelijk bestuursverbod) in cases of serious mismanagement. That disqualification is registered and public.
Employees who report wrongdoing are protected. The Whistleblower Protection Act (Wet bescherming klokkenmelders) has applied since 18 February 2023. Employers with 50 or more employees must have an internal reporting procedure. Reporters are protected against dismissal and other detrimental treatment, and if a reporter is disadvantaged, the employer must prove that the disadvantage is unrelated to the report. An organisation that responds by attacking the reporter turns a compliance problem into an employment dispute and a second news story.
Finally, an employer that names or blames an individual employee in its public statements about an incident is processing personal data. It may also be breaching its duty to act as a good employer (Article 7:611 BW). The urge to explain that one person was responsible is understandable, but it is almost always the wrong move.
Why are sustainability claims a growing risk?
A misleading environmental or social claim is an unfair commercial practice under Articles 6:193a and following BW, and the burden of proving the claim lies with the company. The ACM enforces these rules, and competitors and interest groups also take companies to court over them.
A claim that is vague, not substantiated or true for only part of the product range can be misleading. The ACM has published guidance on sustainability claims and has taken action against companies on this basis. Because these cases attract media attention, a finding against you tends to become public quickly.
Climate litigation shows how the legal and the reputational track can diverge. In 2021 the district court in The Hague ordered Shell to reduce the carbon dioxide emissions of its group by a set percentage. On 12 November 2024 the Court of Appeal in The Hague set that order aside, while confirming that the company owes a duty of care in relation to climate change. An appeal in cassation to the Supreme Court (Hoge Raad) is pending.
The legal outcome is therefore mixed and not final, but the public verdict was formed in 2021. That gap between judgment and narrative is exactly what reputational damage is about. Our analysis of the ruling in the climate case against Shell sets out the reasoning.
How can you reduce the risk before anything happens?
Know in advance who decides what, and within which deadline. Prevention in this area is not a matter of value statements but of preparation.
Four measures make the difference. First, know which reporting duties apply to your organisation and what the deadline is for each of them; 72 hours is short, and 24 hours is shorter. Second, have an internal reporting channel that works and that people trust. The Whistleblower Protection Act may require it, and an internal report is the cheapest early warning there is.
Third, have a lawyer read the first draft of any external statement. A public statement can create liability, can be read as an admission and can conflict with what you told a regulator. Fourth, decide in advance who speaks on behalf of the organisation, so the answer is not improvised on the day.
When an incident does occur, the order that works is always the same. Contain the problem. Establish the facts before commenting on them. Meet the statutory notification deadlines. Acknowledge what is known without speculating about what is not, and explain concretely what you have changed. Silence reads as concealment, and speculation creates a second story.
In summary
- Dutch regulators publish most sanction decisions by name, under the Open Government Act and sector rules such as the Financial Supervision Act.
- You can give your view on an intended publication, object to the decision to publish and ask the court for interim relief under Article 8:81 Awb.
- Data breaches, significant cyber incidents and inside information each come with their own reporting duties, often within 24 or 72 hours.
- Against inaccurate reporting you can seek rectification under Article 6:167 BW; accurate reporting is lawful.
- Prepare in advance: know your deadlines, your contracts and who speaks for the organisation.
Frequently asked questions
How is a published sanction different from bad press?
Bad press is usually a single event that fades. A published enforcement decision is an official document that stays online for the regulator’s retention period and can have legal consequences, for example in tenders, permit applications and loan agreements.
Can a small business suffer the same reputational damage?
Yes. Small and medium-sized businesses often depend on a local customer base and a few key relationships. The publication rules apply to them in the same way, and losing a small number of customers or a bank facility can have a large effect.
Can a company recover from reputational damage?
Recovery is possible, but not guaranteed. It requires more than an apology. Be transparent about what went wrong, take concrete measures and record them, and show over time that the changes are real. Documented remedial measures also count in public procurement.
What should you do first when an incident becomes public?
Establish the facts, check which notification deadlines apply, and make a short, accurate statement. Acknowledge what is known without speculating. Have a lawyer read the statement first, because it can create liability or conflict with what you have told a regulator.
What is meant by the social sentence?
It is the lasting public verdict a company or person faces once wrongdoing becomes known, on top of any fine. In the Netherlands it is often set in motion by the regulator itself, because enforcement decisions are published by name under the Open Government Act and sector legislation such as the Financial Supervision Act.
Why can reputational damage be worse than a fine?
A fine is a fixed amount that can be budgeted and, once paid, is closed. Reputational damage is unpredictable. It can affect customers, staff, financing, insurance and tenders long after the fine has been paid.
Is there a Dutch example of a legal outcome and a public verdict diverging?
The climate case against Shell is one. The district court in The Hague ordered Shell in 2021 to reduce its emissions. The Court of Appeal set that order aside on 12 November 2024, while confirming a duty of care. An appeal in cassation is pending at the Supreme Court, but public opinion formed in 2021.
How do defamation and libel relate to reputational disputes?
They determine when a statement about a person or company becomes unlawful. The civil route runs through Article 6:162 BW, with rectification under Article 6:167 BW. Defamation (smaad) and slander (laster) are also criminal offences under Articles 261 and 262 Sr, prosecuted only on complaint.
Law & More advises companies and directors facing enforcement action and the publicity that comes with it, from the zienswijze and interim relief to notification duties and action against inaccurate publications.
Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.
How Law & More can help you with this is explained on our criminal lawyer page.
