オランダにおけるサイバー犯罪：犯罪行為、罰則、および弁護

Cybercrime in Dutch law covers two groups of offences: offences against computer systems, such as hacking (computervredebreuk), denial-of-service attacks and damaging data, and ordinary offences committed online, such as fraud, extortion and identity misuse. Hacking under Article 138ab of the Dutch Criminal Code (Wetboek van Strafrecht, Sr) carries up to two years’ imprisonment, rising to four years if data are copied; ransomware is usually also prosecuted as extortion, which carries up to nine years.

For a business that is attacked, three tracks run at the same time: a criminal complaint to the police, the notification of a personal data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, and civil liability towards customers and suppliers. For a suspect, the key question is whether the conduct was intentional and unlawful, because every computer offence requires both.

Which offences count as cybercrime in the Netherlands?

The Criminal Code contains specific computer offences and applies classic offences to the digital world. Most computer offences require that the suspect acted intentionally (opzettelijk) and unlawfully (wederrechtelijk).

• ハッキング (Article 138ab Sr): intentionally and unlawfully entering a computer system, for example by breaking a security measure or using a false key or false identity. Maximum two years; four years if the hacker then copies data or misuses the system’s capacity.
• サービス拒否 (Article 138b Sr): intentionally and unlawfully blocking access to a system by sending it data. Maximum two years, higher when a botnet is used.
• Damaging data (Article 350a Sr): changing, deleting or making data inaccessible, for example by encryption. Maximum two years; spreading malware designed to cause damage carries up to four years.
• 恐喝 (Article 317 Sr): forcing someone by violence or threat to hand over goods or data, or to pay. Maximum nine years.
• 詐欺 (Article 326 Sr), for example phishing and fake web shops, and 個人情報の不正使用 (Article 231b Sr).

The Computer Crime Act III (Wet computercriminaliteit III) also gave investigators extra powers. Under Article 126nba of the Code of Criminal Procedure (Sv) the public prosecutor can, for serious offences and with authorisation of the examining magistrate, order the police to enter a suspect’s computer system remotely.

What should a business do after a cyber attack?

Treat the attack as three separate legal tracks with their own deadlines. Start with the data breach assessment, because the 72-hour deadline runs from the moment you become aware of the breach.

Do you have to report a data breach?

Under the GDPR (in Dutch: AVG) a personal data breach must be notified to the Dutch Data Protection Authority without undue delay and where feasible within 72 hours, unless it is unlikely to result in a risk for the people involved. If the risk is high, you must also inform those people. Document every breach internally, including the ones you do not report.

Organisations in critical and important sectors have additional duties under the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026. It replaces the Network and Information Systems Security Act (Wbni) and requires significant incidents to be reported to the competent CSIRT and supervisor within short statutory deadlines, alongside a duty of care for security and board responsibility.

Should you file a criminal complaint?

Yes, a complaint (aangifte) to the police starts the criminal track and is often required by insurers. If the offender is prosecuted, you can join the criminal case as an injured party (benadeelde partij) and claim your direct damage under Article 51f Sv, without starting separate civil proceedings.

Who is liable for the damage?

Customers whose data were leaked can claim damages from the business under the GDPR, and the Data Protection Authority can impose fines of up to €20 million or 4% of worldwide annual turnover. The business, in turn, may have a claim against an IT supplier whose failure contributed to the incident, depending on the contract and its limitation of liability. Directors can be personally liable towards the company only in case of a serious personal reproach.

How do you defend yourself against a cybercrime charge?

A defence usually starts with the elements of the offence: intent, unlawfulness and the evidence that links the suspect to the device or account. Under Article 29 Sv you are not obliged to answer questions, and under Article 28c Sv an arrested suspect may consult a lawyer before the first police interview.

Common defence points are the following. Was access really unlawful, for example because the suspect was authorised as an employee or under a bug bounty programme? Can the prosecution prove who was behind the keyboard, given shared devices, VPNs and hijacked accounts? Was the digital evidence obtained lawfully, for example under a valid order of the examining magistrate (rechter-commissaris) for remote access under Article 126nba Sv? And was the chain of custody of the seized data documented? If evidence was obtained unlawfully, the court can exclude it, reduce the sentence or, in exceptional cases, declare the prosecution inadmissible.

Ethical hackers who report a vulnerability responsibly are in practice often not prosecuted when they follow the organisation’s coordinated vulnerability disclosure policy, but this is not a statutory exemption. Keep the scope limited and document what you did.

What does cybercrime mean for employers and employees?

Under Article 7:611 of the Dutch Civil Code (BW) employer and employee must act as a good employer and a good employee, which includes clear security rules and following them. Serious breaches can justify summary dismissal for an urgent reason under Article 7:678 BW, but only if the rules were clear and the reaction is proportionate.

Monitoring staff to detect threats is allowed only if it is necessary, proportionate and announced in advance, in line with the GDPR. A system to monitor the attendance, behaviour or performance of staff requires the consent of the works council under Article 27(1)(l) of the Works Councils Act (WOR). Employees who report a security flaw or data misuse through the proper channels are protected against retaliation under the Whistleblowers Protection Act (Wet bescherming klokkenluiders).

What should you check as a business hit by an attack?

• Whether personal data were affected, and whether the 72-hour notification to the Data Protection Authority is needed.
• Whether your organisation falls under the Cybersecurity Act and must report the incident to its CSIRT and supervisor.
• Whether you have filed a police complaint and secured logs and other evidence.
• Whether your cyber insurance policy sets notification deadlines or conditions for paying a ransom.
• What your contracts with IT suppliers say about security duties and limitation of liability.

容疑者として確認すべき事項は何ですか？

• Which offence and which article the police mention in the summons or at the arrest.
• Whether you have spoken to a lawyer before the first interview (Article 28c Sv).
• Whether you were authorised to access the system, and whether you can prove it.
• Which devices and accounts were seized, and on which order.
• Whether your employment or residence permit could be affected by a conviction.

What can we do for you with cybercrime?

As 刑事弁護士 we act for both companies and suspects, and we handle the employment-law side of incidents.

• We assess within one working day whether a data breach must be notified to the Data Protection Authority.
• We prepare the police complaint and the injured party claim in the criminal case.
• We assist suspects during police interviews and review the lawfulness of the digital evidence.
• We review IT contracts and claim damages from suppliers where their failure contributed to the attack.
• We draft security and monitoring policies and advise on dismissal after a breach of security rules.

製品概要

• Hacking (Article 138ab Sr) carries up to two years, or four years if data are copied; extortion via ransomware up to nine years (Article 317 Sr).
• Every computer offence requires intentional and unlawful conduct, which is where many defences start.
• A personal data breach must be notified to the Data Protection Authority within 72 hours where feasible.
• Since 15 August 2026 the Cybersecurity Act imposes incident reporting and security duties on critical and important entities.
• As a victim you can claim direct damage in the criminal case as an injured party (Article 51f Sv).

よくある質問