The General Data Protection Regulation (GDPR) requires organizations processing personal data of EU residents to comply with strict data protection principles. Key requirements include: lawful basis for processing (consent, contract, legitimate interest, etc.), transparency through clear privacy policies, data minimization (collect only what's necessary), purpose limitation (use data only for stated purposes), storage limitation (don't keep data longer than needed), and security measures appropriate to the risk.

Practical compliance steps: maintain a processing register documenting what data you collect and why, implement privacy by design in systems, establish data processing agreements with vendors, enable data subject rights (access, correction, deletion), conduct Data Protection Impact Assessments for high-risk processing, and have a breach notification procedure. Many organizations require a Data Protection Officer. Non-compliance risks fines up to €20 million or 4% of global turnover. We help organizations achieve and maintain GDPR compliance efficiently.

A comprehensive software license agreement should define: scope of license (which software/modules, number of users, permitted use cases), license type (perpetual vs. subscription, exclusive vs. non-exclusive), intellectual property rights (who owns what, including improvements and customizations), restrictions on use (no reverse engineering, no competing products, geographic limits), support and maintenance obligations, warranties and liability limitations, and termination conditions.

For SaaS agreements, also address: service levels (uptime guarantees, response times), data ownership and portability, security measures, updates and new features, scalability, and exit procedures. Licensing models vary: per-user, per-device, consumption-based, or flat-fee. Enterprise agreements need additional provisions for integration, customization, escrow arrangements (access to source code if vendor fails), and compliance with the customer's policies. Well-drafted license agreements prevent disputes and protect both parties' interests.

Data breach response requires immediate action following a structured protocol. First 24 hours: contain the breach (isolate affected systems, stop data loss), assess the scope (what data was accessed, how many people affected, what type of data), document everything, and assemble your response team (IT, legal, communications). Under GDPR, you must notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours if the breach poses a risk to individuals' rights.

Next steps: notify affected individuals if high risk exists, implement remediation measures, investigate root cause, strengthen security, and preserve evidence for potential legal proceedings. Communication is critical - prepare clear statements for customers, employees, regulators, and potentially media. Failure to properly report can result in significant fines on top of reputational damage. Having a pre-prepared incident response plan drastically improves outcomes. We help organizations prepare response plans and guide them through actual breach situations to ensure compliance and minimize liability.

By default under Dutch law, the developer retains copyright in custom-developed software even when paid by a client. The client receives only a license to use the software, not ownership. This often surprises clients who assume they own what they paid for. To transfer ownership, the contract must explicitly state that all intellectual property rights transfer to the client ("all rights, title and interest").

Hybrid models are common: client gets full rights to custom code, developer retains rights to reusable components/libraries, or client gets exclusive license with developer keeping technical ownership. Employment creates different rules - employers automatically own IP created by employees during work (but contractors don't automatically transfer rights!). Source code access is negotiable - clients often want source code deposited in escrow accessible if the developer ceases operations. Clear IP provisions in development agreements prevent expensive disputes. We recommend addressing ownership explicitly before development begins.

IT contracts commonly limit vendor liability through caps, exclusions, and disclaimers. Under Dutch law, liability limitations are generally enforceable between businesses (B2B) but face strict scrutiny in consumer contracts (B2C). Common limitations include: capping total liability to fees paid (e.g., 12 months of subscription fees), excluding indirect damages (lost profits, business interruption, data loss), excluding liability for third-party components, and limiting the claims period.

However, you cannot limit liability for: intent or gross negligence (opzet of grove schuld), death or personal injury, violations of mandatory law, or in consumer contracts for defects known to the vendor. Disclaimer language must be clear, specific, and prominent. Boilerplate "no warranties" clauses are often unenforceable. For enterprise contracts, negotiate tiered liability: unlimited for security breaches and IP infringement, higher caps for direct damages, standard caps for other claims. Insurance requirements can provide additional protection. We help both vendors and customers negotiate balanced liability provisions that protect their interests while remaining enforceable.

Source code and technical know-how are protected through a combination of copyright, trade secret law, and contractual measures. Copyright automatically protects the expression of code (but not the underlying ideas or functionality). Trade secret protection requires proving the information: has commercial value, isn't generally known, and you took reasonable steps to keep it secret.

Practical protection measures: implement strict access controls (need-to-know basis, secure repositories, multi-factor authentication), use confidentiality agreements with employees and contractors, include non-compete and non-solicitation clauses for key technical staff, mark materials as confidential, segregate trade secrets from other information, conduct exit interviews and disable access when employees leave, and maintain audit trails. For outsourced development, use strong NDAs and ensure IP assignment clauses. Consider code escrow for critical vendor relationships. Document your security measures - the better your protection, the stronger your trade secret rights. We help companies establish comprehensive IP protection programs tailored to their technology and business model.

The EU AI Act, entering into force in stages from 2025-2027, creates a risk-based regulatory framework for AI systems. The Act categorizes AI into four risk levels: unacceptable risk (banned - e.g., social scoring, real-time biometric surveillance in public spaces), high risk (strict requirements - e.g., critical infrastructure, employment tools, credit scoring, law enforcement), limited risk (transparency obligations - e.g., chatbots must disclose they're AI), and minimal risk (no specific requirements - e.g., AI-enabled games).

High-risk AI systems must comply with strict requirements: risk management systems, high-quality training data, technical documentation, record-keeping, transparency, human oversight, accuracy and robustness, and cybersecurity. Providers must conduct conformity assessments and register systems in an EU database. General-purpose AI models (like large language models) face additional transparency and evaluation requirements. Non-compliance can result in fines up to €35 million or 7% of global turnover. Most business AI tools currently fall under limited or minimal risk, but this may change as the regulation evolves. We help companies assess their AI systems' risk classification and implement necessary compliance measures.

Electronic signatures are legally valid in the Netherlands under eIDAS regulation, which recognizes three types: simple electronic signatures (any electronic method of indicating approval - e.g., typing your name, clicking "I agree"), advanced electronic signatures (uniquely linked to signatory, capable of identifying them, under their sole control, detectable if data is changed), and qualified electronic signatures (advanced signatures using qualified certificates and secure devices, legally equivalent to handwritten signatures).

For most commercial contracts, simple electronic signatures suffice (DocuSign, Adobe Sign, even email confirmation). Advanced signatures provide stronger evidence and are required for certain regulated transactions. Qualified signatures are mandatory for specific legal acts like notarial deeds or certain government filings. Key factors for enforceability: intent to sign, identity verification appropriate to the transaction, secure audit trail, and tamper-evident technology. Some documents still require wet signatures or notarization (real estate transfers, certain corporate resolutions). Digital signature services compliant with eIDAS are widely accepted across the EU. We advise on appropriate signature levels for different transaction types and help implement compliant signature workflows.