Types of legal compliance for businesses in the Netherlands

Legal compliance is the obligation to observe every rule that binds your business: statutes and codes, directly applicable EU regulations, permit and licence conditions, collective labour agreements, and the internal policies you have adopted yourself. For a company operating in the Netherlands those obligations cluster into a limited number of recognisable areas, each with its own supervisor: employment, data protection and cybersecurity, tax and financial reporting, anti-money laundering, competition and consumer law, environment and product safety, corporate housekeeping, and sector-specific licensing. Knowing which areas apply to you, and which authority enforces each of them, is the whole of the exercise.

This article sets out the main types of legal compliance a Dutch business encounters, what each one actually demands, and which regulator will come knocking. It is deliberately an overview rather than a manual: the aim is that you can map your own obligations, see where your gaps are, and know whom you are dealing with when a letter arrives.

Legal compliance and regulatory compliance: what the difference is

The two terms are often used interchangeably, and the distinction is more useful than it looks. Legal compliance is the broad duty to comply with the law as it applies to everyone: the Burgerlijk Wetboek, tax legislation, employment law, criminal law, the general rules on the environment and on personal data. It sets the floor, and it applies whether or not anyone is watching.

Regulatory compliance is the narrower set of obligations that a designated supervisor monitors and enforces, usually in a defined sector or on a defined risk. A payment institution under the Wet op het financieel toezicht, a hospital under the healthcare inspectorate, an operator of an installation under an omgevingsvergunning and a gambling operator under the Wet op de kansspelen are all subject to regulatory compliance in this sense. Its hallmarks are a licence or registration, an ongoing duty to report, powers of inspection, and administrative enforcement instruments such as an order subject to a penalty payment (last onder dwangsom) or an administrative fine.

The practical consequence is that the two are enforced through different routes and on different timescales. A breach of general law usually surfaces through a dispute, a claim or a criminal investigation, and is resolved by a court. A breach of a regulatory rule surfaces through an inspection or a mandatory report, and is resolved administratively, often long before any court is involved and with a much lower threshold for intervention. When you map your obligations, note against each one which route applies, because it determines who needs to be told, how fast you must respond, and whether you are dealing with a supervisor you have to keep talking to afterwards.

Beware of importing frameworks that do not apply here. Anglo-American reference points such as the Sarbanes-Oxley Act or sector codes drawn up for the United States market have no legal force in the Netherlands, however often they appear in compliance software. What binds a Dutch company is Dutch and EU law, supplemented by contractual standards you have agreed to, such as a payment scheme rulebook or a customer audit requirement.

Internal and external compliance: two sources of obligation

External compliance covers everything imposed on you from outside: legislation, EU regulations, permit conditions, collective labour agreements declared generally binding, and the rules of any scheme you have joined. You cannot negotiate these away, and the consequences of breach are set by someone else.

Internal compliance covers the rules you set yourself: a code of conduct, an approval matrix for expenditure, a gifts and hospitality policy, a supplier code, quality standards above the statutory minimum. These are voluntary in origin but not in effect. Once adopted and communicated, an internal rule shapes what a court or supervisor considers reasonable conduct by your organisation, it can become part of the employment relationship, and it is the yardstick against which a dismissal for breach of company rules will be measured. A policy you do not enforce is worse than no policy at all, because it evidences that you identified a risk and then did nothing about it.

The two interlock in a way that matters for liability. Dutch and EU law increasingly requires not merely that you obey a rule but that you can demonstrate you have organised yourself to obey it: the accountability principle in the GDPR, the administrative organisation and internal control duties in financial supervision, the risk inventory and evaluation under working conditions law. In each case the internal system is the external obligation. That is why documentation is not bureaucracy but evidence, and it is the reason a compliance function needs a clear owner with defined responsibilities at board level rather than a shared folder.

Employment and workplace compliance

Employment is where most Dutch businesses meet compliance first, because the rules are mandatory law that cannot be contracted around to the employee disadvantage. Dismissal law sits in Book 7 of the Burgerlijk Wetboek as reshaped by the Wet werk en zekerheid and the Wet arbeidsmarkt in balans, and it is closed in character: an employer needs one of the statutory grounds, and it needs the right route. Redundancy for business economic reasons and dismissal after long-term incapacity run through the UWV; personal grounds such as underperformance, a disturbed working relationship or culpable conduct run through the kantonrechter. Termination by mutual consent is recorded in a vaststellingsovereenkomst (settlement agreement), which the employee may revoke within the statutory reflection period.

Around that core sit the working time rules of the Arbeidstijdenwet, the minimum wage regime of the Wet minimumloon en minimumvakantiebijslag, which since 2024 is expressed as a statutory minimum hourly wage and is adjusted twice a year by the Ministry of Social Affairs and Employment, and the health and safety duties of the Arbeidsomstandighedenwet. The central obligation under the latter is the risico-inventarisatie en -evaluatie: a written assessment of workplace risks with a plan of action, which the Nederlandse Arbeidsinspectie will ask for first. Employing non-EEA nationals brings the Wet arbeid vreemdelingen into play, with work permit or combined permit requirements and identity checks that the inspectorate enforces by administrative fine.

Two developments deserve a place in any current employment compliance plan. Employers with fifty or more employees have been required since the Wet bescherming klokkenluiders took effect to operate an internal reporting procedure meeting statutory requirements, with the Huis voor Klokkenluiders as the external channel. And businesses that make workers available to third parties face the Wet toelating terbeschikkingstelling van arbeidskrachten: registration with the Nederlandse Arbeidsautoriteit runs from 1 November to 31 December 2026, the act enters into force on 1 January 2027, and enforcement follows from 1 January 2028. Hirers as well as agencies are caught, because engaging an unadmitted supplier will itself be prohibited.

Data protection and cybersecurity compliance

Personal data processing is governed by the General Data Protection Regulation, known in Dutch as the Algemene verordening gegevensbescherming, supplemented by the Uitvoeringswet AVG. The regulator is the Autoriteit Persoonsgegevens. There is no general duty to register with the AP before you process personal data; that requirement disappeared when the GDPR replaced the old notification system. What replaced it is accountability: you must be able to show, on request, that your processing is lawful.

In concrete terms that means a lawful basis for each processing operation, a record of processing activities, transparent privacy information, workable procedures for access, rectification and erasure requests, processing agreements with every processor, a documented assessment of transfers outside the European Economic Area, appropriate technical and organisational security measures, and a data protection impact assessment where the processing is likely to result in a high risk. A personal data breach must be notified to the Autoriteit Persoonsgegevens within seventy-two hours of becoming aware of it unless it is unlikely to result in a risk to individuals, and the affected individuals must be told as well where the risk is high. Maximum fines under the GDPR run to twenty million euro or four percent of worldwide annual turnover, whichever is higher.

Cybersecurity is now a separate compliance area rather than an aspect of data protection. The Cyberbeveiligingswet, which implements the NIS2 Directive, has been in force since 15 August 2026. It applies to essential and important entities in designated sectors, requires registration with the Nationaal Cyber Security Centrum, and imposes a duty of care covering risk management, supply chain security, incident handling and business continuity, backed by management responsibility. Significant incidents must be reported through a two-stage process: an early warning within twenty-four hours and a fuller notification within seventy-two hours. Supervision is divided among sectoral supervisors, with the Rijksinspectie Digitale Infrastructuur responsible for digital infrastructure and digital service providers. The first question to answer is simply whether your organisation falls within scope, because size and sector determine that, not your own view of how critical you are.

Artificial intelligence has been added to the same shelf. Under the EU AI Act the prohibitions on unacceptable practices, the obligations for general-purpose AI models and the transparency duties for systems that interact with people or generate synthetic content already apply. The high-risk regime has been postponed by the digital omnibus package, to December 2027 for the systems listed in Annex III and to August 2028 for those covered by Annex I. The separate AI Liability Directive has been withdrawn, so liability for AI-related harm continues to be assessed under ordinary Dutch rules on tort, product liability and contract.

Financial, tax and anti-money laundering compliance

Every business in the Netherlands carries tax obligations: corporate income tax or income tax depending on the legal form, value added tax, and payroll taxes withheld and remitted for employees. The Belastingdienst administers all of these, and the compliance duty is procedural as much as substantive: correct and timely returns, complete records, and an administration that can be audited. The statutory retention period for business records is seven years, and ten years for data relating to immovable property. Our firm does not advise on tax structuring; for the substantive tax position you need a tax adviser, and the sensible division of labour is that the tax adviser determines the position and legal counsel deals with the consequences when a dispute or an investigation follows.

Financial reporting is a company law obligation as much as an accounting one. A BV or NV must prepare, adopt and file annual accounts with the Kamer van Koophandel, at the latest twelve months after the end of the financial year. Late filing is not a formality: it is an economic offence, and in a subsequent bankruptcy it counts as improper management and creates a presumption that the failure was an important cause of the insolvency, which is the mechanism by which directors end up personally liable for the deficit. Companies whose securities are traded on a regulated market carry additional reporting and disclosure duties supervised by the Autoriteit Financiele Markten.

Anti-money laundering compliance under the Wet ter voorkoming van witwassen en financieren van terrorisme applies only to designated institutions, but that list is longer than most people assume: banks, insurers and payment institutions, but also accountants, tax advisers, civil-law notaries, lawyers in certain capacities, estate agents, trust offices, crypto service providers and dealers in goods receiving large cash payments. The duties are client due diligence proportionate to risk, identification and verification of the ultimate beneficial owner at the twenty-five percent threshold, ongoing transaction monitoring, and reporting unusual transactions to FIU-Nederland. The Dutch system reports unusual transactions, not suspicious ones, which is a deliberately lower threshold. Supervision is split between De Nederlandsche Bank, the Autoriteit Financiele Markten, Bureau Toezicht Wwft at the tax administration and the professional bodies. Money laundering itself is a criminal offence under articles 420bis to 420quater of the Wetboek van Strafrecht; the Wwft imposes preventive duties only. Our guide to money laundering in the Netherlands sets out how the two fit together, and firms handling digital assets should also read our note on cryptocurrency compliance risks.

Sanctions compliance sits alongside anti-money laundering and is frequently confused with it, although it binds everyone rather than designated institutions and admits of no risk-based approach. If your business trades across borders, see our guide to sanctions compliance in the Netherlands for screening, the ownership and control test and the reporting duties under the Sanctiewet 1977.

Competition, consumer and contract compliance

The Mededingingswet mirrors EU competition law. Agreements and concerted practices that restrict competition are prohibited, as is abuse of a dominant position, and the Autoriteit Consument en Markt enforces both with investigatory powers that include unannounced inspections of business premises and of digital data. The exposures that catch ordinary companies are rarely textbook cartels: they are information exchanges in a trade association, price or territory understandings between distributors, non-poaching arrangements between employers, and resale price maintenance dressed up as a recommended price. Fines are calculated on turnover, and directors can be fined personally for giving instructions to participate.

The same authority enforces consumer law, which reaches every business selling to consumers. The rules on distance selling, pre-contractual information, the fourteen-day right of withdrawal, unfair commercial practices and unreasonably onerous standard terms are found in Book 6 of the Burgerlijk Wetboek and are enforced both privately, because a consumer can invalidate an unfair term, and publicly, because the ACM can impose fines. The ACM also regulates the energy, telecommunications, postal and transport markets, and since the Energiewet entered into force on 1 January 2026 it applies that act in place of the Elektriciteitswet 1998 and the Gaswet.

Contract compliance is the quiet area that produces most disputes. General terms and conditions must be handed over or made available before or at the time the contract is concluded, or the other party can annul the clauses in them. Statutory limitation and notification periods run whether or not anyone is watching them: a buyer must complain within a reasonable time of discovering a defect, and prescription is interrupted only by a written notice that reserves rights unequivocally. Building a diary for contractual and statutory deadlines is a compliance control, not a legal nicety. For the recurring problems in this area, see our overview of common corporate legal issues.

Environmental, product and premises compliance

The Omgevingswet, in force since 1 January 2024, consolidated the previous patchwork of planning, building and environmental statutes into a single system. Activities with an effect on the physical environment either fall under general rules or require an omgevingsvergunning, and the decentralised authorities, municipalities, provinces and water boards, are the competent bodies, with the regional omgevingsdiensten carrying out inspection and enforcement in practice. Businesses handling waste, discharging to water, emitting to air, storing hazardous substances or operating energy-intensive installations should assume they are in scope and check rather than wait.

Product compliance is EU-driven and increasingly enforced at the border. Placing a product on the EU market requires conformity with the applicable harmonised legislation, CE marking where prescribed, technical documentation, and a responsible economic operator established in the Union. Food businesses answer to the Nederlandse Voedsel- en Warenautoriteit for hygiene, labelling and traceability; consumer product safety, machinery, toys and electrical equipment fall to the same authority. Transport, waste shipment, housing and infrastructure are supervised by the Inspectie Leefomgeving en Transport.

Corporate sustainability obligations belong here too, with a caution. The scope and timing of sustainability reporting have been repeatedly amended at EU level through the omnibus process, and Dutch implementation has trailed behind, so any statement about who reports and from when should be verified against the current position rather than taken from an older article. What is settled is the position on due diligence: after Omnibus I, Directive (EU) 2026/470 removed the harmonised civil liability regime from the corporate sustainability due diligence directive, capped penalties at three percent, and set transposition for 26 July 2028 and application for 26 July 2029.

Corporate housekeeping and sector licences

A set of obligations attaches simply to existing as a Dutch legal entity. Registration in the Handelsregister at the Kamer van Koophandel must be kept current, including directors, authorised signatories and the registered address; an outdated register is what allows a former director to be held out as still authorised. Ultimate beneficial owners must be registered in the UBO register held by the Kamer van Koophandel. General public access to that register was closed following the judgment of the Court of Justice of 22 November 2022, but the registration duty itself is unchanged and access remains open to competent authorities and, in defined circumstances, to institutions with obligations under the Wwft.

Corporate governance supplies a further layer. Directors owe a duty to act in the interests of the company and its business, conflicts of interest must be declared and the conflicted director excluded from the decision, and the two-tier board and works council regimes bring their own consultation and approval requirements. Since 1 January 2025 the Wet aanpassing geschillenregeling en verduidelijking ontvankelijkheidseisen enqueteprocedure has applied, changing the rules on shareholder disputes and on access to the enquiry procedure before the Ondernemingskamer (Enterprise Chamber).

On top of all this sit sector licences. Financial services require authorisation under the Wet op het financieel toezicht from De Nederlandsche Bank or the Autoriteit Financiele Markten. Games of chance require a licence from the Kansspelautoriteit. Healthcare providers answer to the Inspectie Gezondheidszorg en Jeugd and, for tariffs and market conduct, to the Nederlandse Zorgautoriteit. Childcare, private security, taxi transport, waste processing and firearms all have their own regimes. The rule of thumb is that if entry to your market is controlled, the licence conditions are compliance obligations of the first order, and breaching them puts the licence rather than merely your balance sheet at risk.

Who enforces what: the Dutch supervisors at a glance

Compliance becomes manageable once you can name the authority behind each obligation, because that tells you the enforcement instruments you face, the reporting duties you owe and the tone of the conversation you will have. The following is the working map for most businesses.

• Autoriteit Persoonsgegevens: the GDPR and the Uitvoeringswet AVG, data breach notifications and complaints from data subjects.
• Nederlandse Arbeidsinspectie: working conditions, working time, the statutory minimum wage, employment of foreign nationals and, increasingly, labour exploitation.
• Autoriteit Consument en Markt: competition, consumer protection and the regulated energy, telecoms, post and transport markets.
• De Nederlandsche Bank and the Autoriteit Financiele Markten: prudential and conduct supervision of financial undertakings under the Wet op het financieel toezicht, and Wwft supervision of the institutions allocated to them.
• Belastingdienst, including Bureau Toezicht Wwft: tax returns and payments, record-keeping, and anti-money laundering supervision of traders and intermediaries.
• FIU-Nederland: receives reports of unusual transactions and decides which become suspicious transactions passed to investigative authorities.
• Nederlandse Voedsel- en Warenautoriteit: food safety, product safety, labelling and animal welfare.
• Inspectie Leefomgeving en Transport: transport, waste shipment, water and housing.
• Municipalities, provinces and omgevingsdiensten: permits and enforcement under the Omgevingswet.
• Rijksinspectie Digitale Infrastructuur and the sectoral cybersecurity supervisors: the duty of care and incident reporting under the Cyberbeveiligingswet, with registration at the Nationaal Cyber Security Centrum.
• Douane and the Centrale Dienst voor In- en Uitvoer: customs, export control, dual-use licensing and sanctions at the border.
• Sector regulators: Kansspelautoriteit for gambling, Inspectie Gezondheidszorg en Jeugd and Nederlandse Zorgautoriteit for healthcare, and the Nederlandse Arbeidsautoriteit for the admission of labour intermediaries from 2027.

Behind all of them stands the criminal route. The Wet op de economische delicten converts breaches of a long list of regulatory statutes into economic offences, investigated by the FIOD or the inspectorate concerned and prosecuted by the Functioneel Parket. That is the route by which an administrative problem becomes a criminal one, and it is why the decision on how to answer a supervisor first request for information is a legal decision rather than an operational one.

What non-compliance actually costs

The obvious cost is the fine, and the ceilings are high: twenty million euro or four percent of worldwide turnover under the GDPR, turnover-based fines in competition law, and penalty categories under the WED that scale with the seriousness of the offence. But fines are rarely the largest item on the bill.

The second cost is the loss of permission to operate. A supervisor can suspend or withdraw a licence, impose an order subject to a penalty payment that runs daily until you comply, close premises, or prohibit a product from being placed on the market. For a regulated business this is existential in a way that a fine is not, and it takes effect immediately even though an objection or appeal is pending, unless a provisional relief judge suspends it.

The third cost is personal. Directors can be held liable to the company for improper management, to third parties for wrongful acts, and to the estate in bankruptcy where the accounts were not filed or the administration was inadequate. Under article 51 of the Wetboek van Strafrecht an offence committed by a company can also be charged against those who directed it or knowingly permitted it, which means the compliance file becomes evidence about individuals as well as about the entity.

The fourth cost is commercial and rarely appears in a legal memorandum. Banks reassess relationships, insurers reprice or withdraw cover, tender processes require declarations you can no longer make, customers invoke audit and termination rights, and acquirers discount for indemnities. Compliance failures also surface years later in due diligence, where the price is paid a second time. Keeping current, as our note on staying ahead of corporate compliance argues, is far cheaper than remediation under supervision.

Building a compliance programme you can evidence

A compliance programme is a system for turning obligations into behaviour and behaviour into proof. It begins with an obligation register: a single list of everything that binds the business, organised by the areas set out above, with the source, the supervisor, the internal owner and the evidence that shows the obligation is met. Most organisations discover during this exercise that the problem is not disagreement about the rules but the absence of anyone who owns them.

Next comes the risk assessment. Score each obligation on the likelihood of a failure and the severity of its consequences, and be honest that severity is not only financial: a permit at risk outranks a larger fine. Concentrate controls where the score is high rather than spreading effort evenly, and record the reasoning, because a supervisor will accept a deliberate prioritisation far more readily than an undifferentiated checklist that nobody completed.

Controls then need to be designed into the process rather than bolted on. A screening step inside the order intake system, a mandatory field for the lawful basis in the marketing tool, a four-eyes approval on payments above a threshold and an automatic reminder for permit renewal dates all work because they operate without anyone remembering to be compliant. Assign each control an owner with the authority and the budget to make it work, and a reporting line to a board member who is accountable for the whole.

Training belongs to the people who make the decisions in question: sales and procurement for competition and sanctions, marketing and IT for data protection, HR for employment, finance for tax and payments. Keep it concrete and short, repeat it, and record attendance. Add a speak-up channel that satisfies the whistleblower legislation and that people actually trust, and take reports seriously enough to investigate them properly.

Finally, monitor and prove. Set a cadence for internal checks, trace a sample of transactions end to end at least annually, log incidents and near misses, track remediation to completion, and report to the board on a schedule rather than only after something goes wrong. Keep policies version-controlled, register the date each was reviewed, and preserve the evidence for at least the statutory retention period. Where an issue turns out to be a breach, take advice early on whether voluntary disclosure improves your position; in several regimes it does, but only if it comes before the supervisor finds out another way. A compliance lawyer and your corporate lawyer can help you decide that quickly, which is usually what the situation requires.

Frequently asked questions

Law and More advises businesses in the Netherlands across the full range of compliance obligations: employment and works council matters, data protection and cybersecurity, competition and consumer law, anti-money laundering and sanctions, permits and product requirements, corporate governance and directors liability. We help map obligations, build and test programmes, handle investigations and inspections, and represent companies and their directors when a supervisor or the public prosecution service becomes involved. Contact Law and More to discuss where your business stands.