Digital business: these are the rules
When you do business online, you have to deal with several rules that protect both you and your customers. These rules apply, for example, if you sell products through an online shop, have a company website with a chatbot, or when you use AI. In addition, you also have rights if you sell online or use certain services.
It depends on your situation which rules you have to deal with. Do you sell products in your webshop? Then you will have to deal with different rules than if you use an online platform for supply and demand, or a social media platform. There are also rules for dealing with data. Read which rules apply to your situation on this page.
I sell products or services online
You must always comply with the general rules for online sales. These are rules on, for example, consumer reviews, misrepresentation, delivery times, and the cancellation period. Additional rules also apply to these situations:
Read the step-by-step plan to starting an online business to know what you should pay attention to if you sell products in your own webshop.
Can customers sell products through your webshop? Or post images or reviews? Then you usually have to comply with the rules for online services (in Dutch).
Besides having to comply with the rules for online sales, you also have certain rights. For example, you are entitled to clear information from the platform. On how the order of the listed products or services is determined. Or how you or the platform can end the contract, for example.
Are you doing business through the largest platforms? For example, Alphabet (including Google Search and YouTube), Amazon, and Apple (including Appstore). Then you have additional rights. For example, relating to accessing your own and your customers' data. There are also rules on how to contact these kind of online platforms and marketplaces.
You can choose from several payment methods, such as iDEAL, credit card, direct debit, and post-payment. Do you offer pre-payment? If so, you must also offer other options, such as credit card and post-payment. Read more about the rules for online payment methods.
I offer an intermediary online service
Do you have an online platform, hosting company, or social media service, for example? These are intermediary services. You must then comply with rules for intermediary services. For example, on how you inform users and how they can contact you.
Do your users post videos, images, or reviews? Then your service will be subject to data storage rules, among other things. The same goes for images you share via social media (advertising).
Read more about the rules for online platforms and online service providers (in Dutch). Do you have a website or app? Then do the DSA check (in Dutch) to find out which rules for intermediary services apply to you.
Collecting, checking, and passing on data
Do you have an online platform, such as a website or an app, for selling or renting out goods or services? If so, you usually need to collect and check data from your users, for example sellers, rental companies, or service providers. You also need to pass on this data to the Netherlands Tax Administration.
Working with data
If you do business online, you will be dealing with data. There are rules for handling data properly. For example, for the data you collect from users or customers. Or via an app, for instance to analyse data for marketing or sales.
There are also rules for sharing data easily. For example, if a customer has bought a car and wants to share data with a garage for repair. Or if the user of a machine wants to improve business processes by viewing data on usage.
If you store customer data, you must comply with privacy rules. For example:
- You must make clear what data you collect and what you do with it.
- You must keep personal data secure so that others cannot steal or view it.
- You are not allowed process certain personal data. For example, about background, political opinions, and health.
Read more about the privacy rules for business owners (GDPR).
You must also publish a privacy statement on your website or online shop. This lets your customer know what you do with personal data and why.
Do you analyse data? Such as customer data for marketing? What is and is not allowed depends on the type of data. Are you working with sensitive data, for instance? Such as medical data. Then you must:
- be clear about what you do with the data
- have the client's permission
- take security measures
Do you offer services that connect data holders and data users for the purpose of sharing data? For example, through a data marketplace. If so, you may have a data mediation service (in Dutch) that you need to register. types of services may not use the data they receive for anything else.
Do you make or sell smart devices? Such as smartwatches, smart doorbells, or robotic vacuum cleaners. As of September 2025, you must comply with these data rules, among others:
- Users must be able to easily and freely access and share their own data.
- You must provide information in advance about, for example, what data the device and its app collect and who uses the data.
Do you store data from, for example, your accounting or inventory software in a cloud? If you want to switch to another cloud service provider, you may take your data with you (in Dutch). This will apply from September 2025.
Do you use different cloud service providers at the same time? These should allow you to exchange your data with each other (in Dutch) if you want.
I want to use AI responsibly and safely
Do you want to use artificial intelligence (AI) for images in your web store, for example, or a chatbot? Or are you developing or importing an AI system? What is and is not allowed with AI depends on:
- whether your application is an AI system according to the law
- whether your AI system falls into the low- or high-risk category
- Whether you are the provider or controller of the AI system
Read more about the security rules around AI.
I trade crypto
Do you trade in digital money? Or are you a crypto wallet provider? If so, you must apply for a licence from the Netherlands Authority for the Financial Markets (AFM).
Do you sell fintech products? Read which rules you have to comply with and where you can find more information.
Making digital products safe and accessible
Products with digital components must be cybersecure. For example, there are rules on how to safely design, produce, and secure digital products. Such as baby monitors, Wi-Fi routers , video games, and mobile apps. The rules apply to hardware and software marketed in the EU from 11 December 2027.
In addition, digital products and services must also be completely accessible to people with a disability from 28 June 2025 . This applies to e-books and computers, for example. Does your business have 10 or more employees, or more than €2 million turnover per year? And do you offer products or services via a web store or website? Then your website or web store must be fully accessible for people with a disability from 28 June 2025. With the self-scan (in Dutch) provided by SME Netherlands, Accessibility, and Thuiswinkel.org, you can see how accessible your website is at the moment. And what you need to improve.
Read more about the rules for accessible websites and apps (in Dutch).
Overview of EU laws on digitisation
In the coming years, more rules for online business will be introduced in the European Digital Decade programme. The rules you may have to deal with come from various European laws. Such as: