New cyber legislation to take effect for thousands of Dutch companies from 2026
As of August 15, 2026, more than 8,000 Dutch organizations will face stricter rules regarding digital security. The new Cybersecurity Act is the Dutch implementation of the European NIS2 directive. This law is intended to significantly increase the digital resilience of key sectors in the Netherlands.
The legislation sets clear requirements for how companies secure their IT systems and how they handle cyber threats. Organizations will be required to better map out risks and respond more quickly to incidents. This is a necessary step, as cyberattacks are becoming increasingly frequent and can have a major impact on society.
Notably, the new rules also have consequences for the crypto sector. Through the DORA (Digital Operational Resilience Act) regulation, crypto companies are being more closely integrated into general cybersecurity standards. This means that they, too, must ensure their digital systems comply with the new European standards for security and reliability.
With these measures, the government aims to prevent vital processes in the Netherlands from grinding to a halt due to hacks or data breaches. Companies covered by the new law have until the summer of 2026 to adapt their security to the new requirements. It is therefore important for many organizations to start their preparations now.