An IT lawyer is an advocaat, registered with the Dutch Bar Association (NOvA), who advises on and litigates about software, data and digital services: IT contracts, the GDPR, the AI Act, the Cyberbeveiligingswet (the Dutch NIS2 act) and IT disputes. The main exception: an IT legal consultant without a bar qualification can also advise, but has no legal privilege and cannot act where representation by a lawyer is mandatory.
What is an IT lawyer?
An IT lawyer is a lawyer who specialises in legal issues surrounding information technology, software, digital services and data. Whereas a generalist covers multiple areas of law, an IT lawyer focuses specifically on the intersection of technology and law: from software contracts and privacy to cybersecurity and the new AI regulation.
The field has existed for decades, but has changed drastically in recent years. Where an IT lawyer used to deal mainly with software licences and hosting contracts, the field today covers a broad range of complex regulation: the General Data Protection Regulation (GDPR), the European AI Act, the NIS2 Directive, implemented in the Netherlands by the Cyberbeveiligingswet, the Data Act and various legislation on e-commerce and intellectual property.
An IT lawyer speaks both languages: that of technology and that of the courtroom. That makes a difference when you need a contract reviewed that is full of technical specifications, or when you need to demonstrate to a judge that a software supplier has failed to meet its obligations.
When do you need an IT lawyer?
Many businesses bring in an IT lawyer too late — only once something has already gone wrong. But preventive legal advice is at least as valuable as remedial action after the fact when it comes to IT matters. You need an IT lawyer in the following situations.
When entering into IT contracts
Software licence agreements, SaaS contracts, cloud agreements and IT implementation contracts contain clauses on liability, intellectual property and exit arrangements that can have far-reaching consequences. An IT lawyer protects your interests before you sign.
When developing software
When you have software developed — by an external agency or by permanent staff — it must be clearly recorded who owns the rights to the source code. Without clear contractual agreements, you may discover after a dispute that the software supplier owns the code you paid for.
In the event of a data breach or cyber incident
Following a data breach, you have a 72-hour obligation to notify the Dutch Data Protection Authority. Depending on the severity, you may also need to inform the individuals affected. An IT lawyer guides you through this process, limits liability and coordinates communication.
For compliance matters
The GDPR, the AI Act, the NIS2 Directive and the Data Act impose concrete obligations on businesses that use or develop technology. The penalties for non-compliance are steep: up to €20 million or 4% of global annual turnover under the GDPR. An IT lawyer helps you demonstrate compliance.
In an IT dispute
If an IT implementation project fails, a supplier falls short of its SLA obligations, or a conflict arises over software ownership, you need a lawyer who understands the technical reality and can act effectively — both out of court and before a judge.
To protect intellectual property
Software is protected by copyright, but that protection is not automatically watertight. Databases have their own separate database right. An IT lawyer helps protect your digital assets and takes action against infringement.
What are the core areas of IT law?
What should a software, SaaS or cloud contract cover?
IT contracts form the foundation of every digital business operation. Whether it concerns a software delivery contract, a SaaS subscription or a cloud migration project, the legal risks are hidden in details that look harmless at first glance.
Critical clauses in IT contracts include: limitation of liability, ownership of source code and data, uptime guarantees (SLAs), exit arrangements and data return, and security obligations. An IT lawyer reviews these clauses from your perspective — not from that of the supplier who drafted the contract.
Read more: Drafting a software contract — what should you look out for?
Who owns the software you paid for?
Software is protected by copyright under the Dutch Copyright Act. But who actually holds that copyright? For software written by an external developer, it is in most cases the developer, unless otherwise agreed in writing; for software written by employees in the course of their work, it is the employer under Article 7 of the Copyright Act (Auteurswet). This regularly leads to disputes when a client assumed they owned software they had commissioned.
Alongside copyright, database rights can apply to collections of data, and patents may be relevant for technological inventions. An IT lawyer maps out your IP position and ensures contracts correctly record ownership rights.
Read more: Intellectual property and software — who owns the code?
What does the GDPR require from your business?
The GDPR applies to virtually every business that processes personal data. That sounds abstract, but in practice it means: data processing agreements with your IT suppliers, a register of processing activities, a privacy policy that meets the information duty, technical and organisational security measures, and a procedure for handling data breaches.
An IT lawyer translates GDPR obligations into concrete steps for your organisation and helps draft the required documents.
Read more: GDPR and IT — the obligations many businesses overlook
What does the Cyberbeveiligingswet (NIS2) require?
The Netherlands implemented the NIS2 Directive late. The Cyberbeveiligingswet, the Dutch Cybersecurity Act, entered into force on 15 August 2026; before that date the directive itself had no direct effect on private organisations. The Act requires organisations in designated sectors — including energy, transport, digital infrastructure, health, water and government — to take appropriate technical and organisational measures, to register, and to report significant incidents with an early warning within 24 hours of becoming aware of them, followed by a fuller notification within 72 hours. Directors can be held personally accountable for the duty of care.
NIS2 also requires organisations to assess security risks in their supply chain. That means your IT contracts with suppliers need to include NIS2-compliant security requirements. An IT lawyer helps you determine whether the Directive applies to you, which measures are required, and how to adapt your contracts.
Read more: The NIS2 Directive — what do you need to arrange now as a business owner?
What does the AI Act require, and from when?
The European AI Act is the first comprehensive statute anywhere to regulate AI systems, and it applies in stages rather than all at once. The ban on prohibited AI practices and the AI literacy duty have applied since February 2025, and the rules for general-purpose AI models since August 2025. The transparency duties of article 50 — telling people they are dealing with an AI system, and labelling synthetic content — also already apply. The high-risk regime is the part that has moved: the digital omnibus package postponed the obligations for the Annex III high-risk systems to December 2027 and those for Annex I products to August 2028. The separate AI Liability Directive was withdrawn, so damage caused by an AI system is dealt with under ordinary Dutch liability law and the revised Product Liability Directive.
For many businesses, the question is: does my AI application fall under the AI Act, and if so, in which risk category? An IT lawyer analyses your use of AI and helps you take the right compliance measures.
Read more: The AI Act — what does the new EU regulation mean for your business?
How are IT disputes and liability resolved?
Large IT implementation projects run late, exceed budget or are abandoned more often than projects in most other sectors. When that happens, the question is who bears the loss, and the answer usually turns on what was agreed about specifications, acceptance and warnings.
An IT lawyer assesses contractual liability, gathers evidence (technical documentation, email correspondence, acceptance protocols) and negotiates a settlement or starts proceedings. Arbitration through the Netherlands Arbitration Institute (NAI) or the SGOA (Stichting Geschillenoplossing Automatisering, the Dutch IT arbitration institute) is often faster and cheaper than full court proceedings.
Read more: IT disputes — what are your legal options?
Which rules apply when you sell online?
Selling online brings specific legal obligations: the 14-day right of withdrawal (Article 6:230o BW), information duties for webshops, cookie law compliance, rules on digital products, and the rules on distance contracts (article 6:230g et seq. of the Dutch Civil Code, implementing the EU Consumer Rights Directive). Breaching these rules can lead to fines from the Dutch Authority for Consumers and Markets (ACM) and reputational damage.
An IT lawyer ensures your terms and conditions, privacy statement and cookie policy are legally sound and that your webshop complies with all consumer protection legislation.
What is the difference between an IT lawyer and an IT legal consultant?
The terms are often used interchangeably, but there is a legally relevant distinction.
An IT lawyer is registered with the Dutch Bar Association (NOvA) and, as a result, has professional secrecy (everything you share is covered by legal privilege, even in court proceedings), the exclusive right to represent you where representation by a lawyer is mandatory, such as at the district court in claims above €25,000, is subject to disciplinary oversight (misconduct can be reported to the disciplinary board), and is required to carry professional indemnity insurance.
An ICT or IT legal consultant without a bar qualification can provide legal advice, but lacks legal privilege and the right of representation in court. For purely advisory work that may be sufficient; as soon as proceedings are likely, or you want to share confidential information without the risk of forced disclosure, you need a lawyer.
What does an IT lawyer cost?
There is no fixed or regulated tariff for legal services in the Netherlands. Hourly rates differ considerably between firms and depend on the size and location of the practice and the seniority of the lawyer, and they are reviewed periodically, so any figure quoted in an article dates quickly. Ask for the current rate in writing before the work starts.
Whether you qualify for subsidised legal aid depends on your income and assets and is assessed by the Legal Aid Board (Raad voor Rechtsbijstand); for businesses it is not available, so commercial IT work is always privately funded.
For standard services such as drafting a data processing agreement or reviewing a SaaS contract, it is sometimes possible to agree a fixed price. Ask about this during the introductory meeting.
Factors that affect the total cost include: the size and complexity of the contract or dispute, the stage involved (advice and contract review are cheaper than proceedings), urgency (urgent advice following a data breach comes at a higher cost), and the number of parties involved in a dispute.
What should you check as a customer of IT services?
Most IT disputes go back to a contract that did not say who delivers what. Check these points before you sign.
- Whether the limitation of liability leaves you a realistic claim if the system fails.
- Whether the source code and your data belong to you, or at least are placed in escrow.
- Whether the SLA sets measurable uptime and response times, with credits if they are missed.
- Whether the exit clause obliges the supplier to return your data in a usable format.
- Whether a data processing agreement under Article 28 GDPR is in place.
What should you check as an IT supplier?
Suppliers carry duties to warn and to cooperate that the contract does not always mention. Check these points in your standard terms and projects.
- Whether your general terms were validly made available before or when the contract was concluded (Article 6:234 BW).
- Whether the specifications and acceptance procedure are recorded in writing.
- Whether you warned the customer in writing about risks you saw in its requirements.
- Whether your customers fall under the Cyberbeveiligingswet and will expect supply-chain security clauses.
- Whether the IP licence you grant matches what the customer thinks it is buying.
What can we do for you with an IT law question?
Our IT lawyers in Eindhoven and Amsterdam advise technology companies, start-ups and established businesses, including in the Brainport region.
- We review SaaS, licence and cloud contracts on liability, source-code ownership and exit arrangements.
- We draft data processing agreements and your GDPR documentation.
- We assess after a data breach whether it must be notified to the AP within 72 hours, and draft the notification.
- We determine whether the Cyberbeveiligingswet or the AI Act applies to you and which measures follow.
- We conduct IT disputes before the courts, the NAI or the SGOA.
- We agree the fee arrangement in writing before any work begins.
Summary
- An IT lawyer is a bar-registered advocaat specialising in technology, software and digital services, with legal privilege and the right to act in proceedings.
- The core areas are IT contracts, IP and software, privacy, cybersecurity, AI regulation, IT disputes and e-commerce.
- The Cyberbeveiligingswet has applied since 15 August 2026; the AI Act high-risk obligations follow on 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- A personal data breach must usually be notified to the AP within 72 hours (Article 33 GDPR).
- Fees are agreed in advance: an hourly rate, or a fixed price for standard work such as a data processing agreement.
Frequently asked questions
What legislation falls under IT law?
IT law is not a separate code, but an umbrella field covering multiple laws and regulations. The most important are: the General Data Protection Regulation (GDPR), the European AI Act, the NIS2 Directive (implemented as the Cyber Security Act), the Data Act, the Dutch Copyright Act (for software copyright), the Databanks Act, the Telecommunications Act, the rules on distance contracts (article 6:230g et seq. of the Dutch Civil Code, e-commerce) and the Dutch Civil Code for contract law generally.
Do I need an IT lawyer for my GDPR policy?
Not always, but it is advisable for larger organisations or more complex processing activities. An IT lawyer helps you set up a record of processing activities, review or draft data processing agreements, and put in place a procedure for data breaches. For smaller businesses, a combination of a privacy policy template and one-off legal advice is sometimes sufficient.
What does an IT lawyer do in the event of a data breach?
A data breach triggers a 72-hour notification obligation to the Dutch Data Protection Authority. An IT lawyer immediately assesses whether the breach is notifiable, guides the notification process, advises on communication with those affected, limits liability towards customers and suppliers, and investigates whether there is a breach of contract by a supplier or a criminal offence under cybercrime law.
Can an IT lawyer also litigate?
Yes. An IT lawyer is a fully qualified advocaat and can represent you before any Dutch court, including at the district court, where representation by a lawyer is mandatory for claims above €25,000. For IT disputes the usual forums are the civil courts, summary proceedings (kort geding) for urgent matters such as IP infringement, and arbitration through the NAI or the SGOA. Many IT disputes are settled through negotiation or mediation.
What is the difference between an IT lawyer and a data protection officer (DPO)?
A Data Protection Officer (DPO) is an internal or external supervisor who ensures your organisation complies with the GDPR. An IT lawyer provides legal advice and can represent you in a dispute or legal proceedings. The two roles complement each other: the DPO oversees day-to-day GDPR compliance, while the IT lawyer acts when legal action is required.
