Netherlands. Cybersecurity. Act
CbwCybersecurity Act (Cyberbeveiligingswet – Cbw)
In force
Partly verified
Medium confidence.BWBR identifier and Staatsblad number for the Act itself not found; text_url is the portal root.
§1Summary
- Synopsis
The Cbw transposes NIS2 in the Netherlands, replacing the Wbni. It imposes registration, risk management and incident-reporting duties on essential and important entities, with sector-based supervision.
- Key themes
- Unique features
Adopted alongside the Critical Entities Resilience Act (Wwke); supervision split across sector regulators.
- SaaS relevance
Cloud, SaaS and managed service providers above NIS2 size thresholds established in the Netherlands must register and report significant incidents.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- CSIRT/supervisor: 24h early warning, 72h notification, 1-month report
- Cross-border transfers
- None
- Maximum penalty
- Essential: up to €10m or 2%; important: up to €7m or 1.4%
§3Dates
- Key dates
- Adopted
- In force
- Tweede Kamer vote 2026-04-15; Eerste Kamer 2026-07-07; Cyberbeveiligingsbesluit Stb. 2026, 189 (8 July 2026); in force 2026-08-15
§4Text and authority
- Text
- Authoritative text wetten.overheid.nl
- Authority
- Sector supervisors incl. Rijksinspectie Digitale Infrastructuur (RDI) for digital providers; NCSC as CSIRT
§5Where it applies
- Domestic law of
- Netherlands
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.BWBR identifier and Staatsblad number for the Act itself not found; text_url is the portal root.