Reporting cybercrime (Wbni act)

This information is provided by

Netherlands Enterprise Agency, RVO

Do you offer digital services or do you supply critical services? You need to take measures to protect your business from cybercrime. In case of a cyber security incident you need to report this. This is regulated in the Act on the security of networks and information systems (Wet beveiliging netwerk- en informatiesystemen, Wbni), the Dutch implementation of the EU's NIS-directive.

When are you a supplier of critical services?

You are considered a supplier of a critical service if this service is essential to Dutch society. Examples are:

  • gas production and distribution
  • drinking water supply
  • transport
  • financial transactions

If you are considered part of the critical infrastructure the Ministry of Economic Affairs and Climate Policy will let you know.

When are you a digital services provider?

A supplier of digital services, Digital Service Provider (DSP), is a legal entity that supplies 1 or more of these services:

  • electronic (online) marketplace
  • cloud service
  • search engine

As a DSP you are subject to the Wbni act if you meet these criteria:

  • Your company has its headquarters or a representation in the Netherlands.
  • You have at least 50 employees.
  • Your total assets or your yearly turnover amounts to over €10 million.

Duty of care: protection from cybercrime

You must ensure you have the right security measures and products to protect your company from cybercrime. For instance, protection against viruses, malware, and ransomware. You must prevent damage to networking and information systems.

Duty to report cybercrime

Has your company encountered a cybersecurity incident? And does this incident have major consequences? Or are your ICT systems damaged to such an extent that you can no longer provide your services? You always need to report this to:


  • the Radiocommunications Agency (Agentschap Telecom) – for suppliers of critical services (in Dutch, scroll down for notification forms in English)
  • CSIRT-DSP, an agency of the Ministry of Economic Affairs and Climate Policy – for digital service providers

This information is provided by

Netherlands Enterprise Agency, RVO