Question 1

Does NIS2 apply to my company?

Accepted Answer

1. Check the sector. Annexes I and II list energy, transport, water, banking, financial markets, health, government, digital infrastructure, ICT service management, space, food, chemicals, manufacturing of critical goods, digital providers, and research.
2. Count headcount and revenue. Below 50 FTE and EUR 10M revenue you are out of direct scope, unless you are the only NL provider of that service.
3. Do you serve a customer who is in scope? Then NIS2 reaches you indirectly through their supplier management, contractually.
4. Use the official RDI NIS2 self-assessment to confirm whether you are an essential or important entity.
5. Write down the result with date and source. Re-run when the law or your revenue changes.

When to bring us in: 
Unclear sector classification or you supply multiple essential entities at once? Then a legal review beats guessing.

Question 2

What changes with the Dutch Cyber Security Act?

Accepted Answer

1. Three pillars match NIS2: duty of care, notification duty, and board responsibility.
2. Duty of care means technical and organisational measures proportional to risk, documented like an ISMS.
3. Notification: significant incidents go to CSIRT and the supervisor within the statutory window. Confirm timing via NCSC.
4. Board responsibility: directors must adopt and follow the policy, train, and can be personally liable. Record the decision in board minutes.
5. Follow the bill via tweedekamer.nl and NCSC for the final date and secondary rules.

When to bring us in: 
Essential entity with no ISMS in place yet? You will not make it solo. Bring in external help early.

Question 3

Am I personally liable as a director under NIS2?

Accepted Answer

1. Assign cybersecurity to a named board member, not to an external IT vendor (even if they do the execution).
2. Take the required training. NIS2 obliges board members to demonstrate risk-management knowledge. NCSC and trade associations offer short courses.
3. Minute the decisions: risk overview, chosen measures, budget, and who owns execution.
4. Take out D&O insurance or check that your current policy covers cyber negligence. Not all do.
5. Have an external party assess the measures at least once a year. That evidence supports a "reasonable conduct" defence.

When to bring us in: 
In an active incident where you realise you cannot document due diligence, get legal counsel involved immediately.

Question 4

What is a processing register and how do I build one?

Accepted Answer

1. Open a sheet or use the AP template. One row per processing: name, purpose, types of subjects, types of data.
2. Add the retention period and the legal basis (consent, contract, legal duty, legitimate interest).
3. List recipients per processing: HR tool, accounting, mail provider, external parties. Non-EEA countries separately.
4. Describe the security measures at a high level: MFA, encryption, access control, backup.
5. Review every six months or whenever a new tool comes in. The register need not be public but must be available on request to the AP.

When to bring us in: 
Processing special-category data (health, BSN, biometric) across multiple systems often needs a DPIA on top. Happy to scope it.

Question 5

Do I need to run a DPIA?

Accepted Answer

1. Check the AP DPIA list. If your processing is on it, DPIA is mandatory.
2. Also walk the WP29 nine criteria (scoring, automated decisions, systematic monitoring, special-category data, large scale, dataset combining, vulnerable subjects, novel tech, blocking of rights). Two or more hits means: run one.
3. Use a fixed template. Description, necessity, risk analysis, measures, residual risk. AP and NOREA templates work.
4. Involve the DPO if you have one; their advice belongs in the document.
5. Keep it as a living document, updated when the processing changes.

When to bring us in: 
High residual risk after measures means prior consultation with the AP. That is not a formality. Let us scope it first.

Question 6

Do I have to appoint a Data Protection Officer?

Accepted Answer

1. Walk the three triggers in GDPR Art. 37. None hit? DPO is not mandatory, but advisable for larger SMBs.
2. A DPO can be internal or external. Requirements: independent, sufficient knowledge, sufficient time. May not combine with a role that decides on processing (privacy officer is fine, head of IT is not).
3. Register the DPO with the AP via their online form. That is a statutory duty.
4. Give the DPO a mandate: direct line to the board, access to all processing, no sanctions for advice.
5. Document when the DPO must be consulted: DPIA, breach, new tools, processor agreements.

When to bring us in: 
Unsure whether your processing is "large-scale" in the GDPR sense? It is a grey area the AP publishes case law on. We can help size it.

Question 7

Do I need a Data Processing Agreement with this vendor?

Accepted Answer

1. Decide the role. Processor when they only execute (cloud storage, mail provider, payroll). Controller when they set purpose and means (bank, accountant). The latter does not need a DPA but does need clear terms.
2. Ask the vendor for their standard DPA. Microsoft, Google, AWS, Salesforce all publish one and you accept it in their portal. Print the proof.
3. Confirm purpose, data types, retention, sub-processors and non-EEA transfers are spelled out. Generic DPA without an annex is not enough.
4. Custom DPA? Use the AP model or a NOREA template as the base. Writing from scratch goes wrong more often than not.
5. File the signed copy in the processing register entry for that activity.

When to bring us in: 
Vendor refuses a DPA or wants unlimited sub-processors? That is not a vendor issue, it is a red flag. Call us before you sign.

Question 8

Does the Microsoft DPA count as a processor agreement?

Accepted Answer

1. Pull the current version from Microsoft 365 admin > Privacy & data > Data Protection Addendum, or via the Microsoft Trust Center.
2. Also pull the Products and Services DPA and the Data Subject Requests annex. The main DPA references them.
3. Save the PDF with date in your compliance folder. Microsoft updates the document; you want to prove which version applied when.
4. Record in the processing register: vendor Microsoft, basis Microsoft DPA, download date, Trust Center link.
5. Same flow works for Google Workspace, AWS, Atlassian, Salesforce, Adobe. Every large SaaS publishes one.

When to bring us in: 
In healthcare or government, a generic DPA may not cover sector requirements. Then you negotiate a sector annex. Do not DIY that.

Question 9

What do I do in the first hour after a data breach?

Accepted Answer

1. Log everything from minute zero. Time, reporter, signal, first action. You will need this for the AP notification and possibly insurance.
2. Containment: isolate the compromised account or system. Reset passwords, revoke session tokens, take the device off the network.
3. Categorise the breach. Misdirected email, lost laptop, ransomware, account takeover, accidental disclosure. The category drives next steps.
4. List the personal data potentially affected. Which fields, how many records, which subjects. First estimate is fine; refine later.
5. Call your DPO or, if none, your IT partner. Not the AP yet; that comes at step six.

When to bring us in: 
Active ransomware or thousands of records affected? Stop DIY. Call us or another CSIRT partner before you click anything else.

Question 10

Do I have to inform the data subjects about a breach?

Accepted Answer

1. Assess the risk. What data, what consequences, how many people. Identity fraud, financial loss, reputational damage, discrimination are classic high-risk markers.
2. Document why you do or do not inform. It is your call, but you must defend it to the AP.
3. If informing: plain language, what leaked, what risk, what you are doing, what the subject can do, DPO or contact point.
4. Use a channel you already use: email or letter. A site banner alone is not a direct notification under GDPR.
5. Log the communication in the register: when, how, how many recipients.

When to bring us in: 
Doubt about high risk on medical or financial data? Default to informing. For large groups (>1000), get communications-specialist advice.

Question 11

How long may I retain personnel files?

Accepted Answer

1. Payroll and wage-tax statements: 7 years after end of employment (Belastingdienst fiscal retention).
2. ID copy: at least 5 years after the calendar year in which employment ended, under the Dutch payroll administration duty (Wet op de loonbelasting).
3. General personnel file (contract, reviews, leave): usually 2 years after end of employment, longer only with an active matter.
4. Rejected applicants: max 4 weeks. With explicit consent for a talent pool: max 1 year.
5. Capture this per document type in a retention schedule. Schedule periodic clean-up.

When to bring us in: 
Special cases like sick-leave data, first-aid certificates, or workplace accidents have different periods. When in doubt, ask the arbodienst or an employment-law advisor.

Question 12

How long may I retain customer data?

Accepted Answer

1. Split by purpose. Accounting and invoicing: 7 years (fiscal). Warranty and service: contract term plus a few years. Marketing: as short as defensible, often 2-to-3 years after last interaction.
2. Capture the period in the processing register and in the privacy notice toward the customer.
3. Configure automatic clean-up where possible. CRMs and mail platforms have retention filters; use them.
4. Anonymise rather than retain where possible. Anonymised data falls outside GDPR.
5. Document a deletion procedure including backups, or old records survive via your restore set.

When to bring us in: 
Medical, financial, or criminal data have stricter rules (NEN 7510, Wft, Wpg). Get specialist advice rather than guess.

Question 13

Can I store customer data in a US cloud?

Accepted Answer

1. Check whether the vendor is on the DPF list (dataprivacyframework.gov). Microsoft, Google, AWS, Salesforce are; many smaller ones are not.
2. On the list: log "transfer under DPF" in the processing register. That is sufficient basis.
3. Not on the list: use the European Commission Standard Contractual Clauses (2021 version or later). Usually already in the DPA.
4. Run a Transfer Impact Assessment. Short form: what data, what country, which laws may compel access (FISA 702, CLOUD Act), what supplementary measures (encryption, EU-only key management).
5. File the TIA with the DPA. The AP can ask for it.

When to bring us in: 
Special-category data or large scale make a TIA hard to land. Get legal advice.

Question 14

We supply banks, does DORA hit us?

Accepted Answer

1. Confirm whether your customer is a financial entity under DORA: bank, insurer, investment firm, payment institution, credit institution. Then DORA reaches you contractually.
2. Expect contract updates: incident reporting within fixed windows, supervisor audit rights, exit strategy, transfer requirements.
3. Build incident detection and logging at a level where you can produce facts in hours, not days. SLA reporting alone is too slow.
4. Document concentration risk. If you use sub-suppliers for core function, your customer needs to know.
5. Keep test evidence. Pen tests, scenario tests, business-continuity drills will be requested.

When to bring us in: 
Designated as a "critical ICT third party" by the ESAs? You are directly supervised. Different game; bring in legal and compliance specialists.

Question 15

EU AI Act, what hits me as an SMB?

Accepted Answer

1. Define your role: provider (you build or sell), deployer (you use), importer, or distributor. Duties differ.
2. Assess the risk class: banned, high-risk, limited, minimal. Annex III of the Act lists them.
3. For minimal-risk tools (chatbots, mail assistants, summarisers), transparency usually suffices. Disclose AI-generated output.
4. For high-risk (HR, credit scoring, critical infrastructure, biometrics) you face risk management, data quality, technical documentation, logging, human oversight, robustness. Not DIY; ask the vendor for their conformity declaration.
5. Maintain an internal register of AI tools in use. It will be as routine as the GDPR processing register.

When to bring us in: 
Building a high-risk system yourself or training a foundation model above 10^25 FLOPs? Different regime. Get specialist counsel.

Question 16

Customer asks for ISO 27001 or NEN 7510, what fits us?

Accepted Answer

1. Ask the customer which norm they really require. A tender often says ISO 27001 but accepts equivalents like NEN 7510 or TISAX.
2. Estimate effort. First certification typically takes months of preparation plus an audit by an accredited body.
3. Start with a gap analysis against ISO 27001:2022 Annex A (93 controls grouped into 4 themes) or NEN 7510 clauses. Output: your action list.
4. Build or buy an ISMS: document structure, risk assessment, statement of applicability, internal audit, management review.
5. Plan at least 6 months between "everything in place" and the audit so the system has evidence of running.

When to bring us in: 
In hybrid healthcare (medtech, e-health, GGD links), NEN 7510 plus NEN 7512 is often required. Call us before hiring an auditor.

Question 17

Can ISO 27001 be done lighter for a small company?

Accepted Answer

1. Tighten scope. Not the whole BV but the service you deliver. Targeted scope certifies faster and cheaper.
2. Re-use existing documents. Personnel handbook, GDPR register, vendor DPAs, backup procedures already fulfil multiple controls.
3. Pick a sized approach. Template kits or a light implementation via an external consultant. Most SMBs land it that way.
4. Run PDCA once before the audit. If the cycle stays on paper, the auditor will spot it.
5. Schedule the external audit only after one internal audit round with findings actually closed.

When to bring us in: 
Customer demands full Annex A coverage and you have under 10 staff? An SMB-specialised firm is much faster. We can point at parties.

Question 18

E-invoicing is becoming mandatory, what do I sort now?

Accepted Answer

1. Understand the distinction. A PDF in email is not an e-invoice. An e-invoice is a structured format (UBL or Peppol BIS), machine-readable.
2. Check your accounting tool. Exact, AFAS, Twinfield, Moneybird, e-Boekhouden, Yuki all have Peppol links or UBL export.
3. Connect to the Peppol network via an access point. Many accounting tools include this; otherwise pick a separate access-point provider.
4. Test first with a receiving customer or a test endpoint at your access point. Format errors on a real invoice waste days.
5. Plan your inbound flow as well. Not only send, but receive and post automatically.

When to bring us in: 
Supplying large retailers, health insurers, or government and not yet on Peppol? That is urgent now, not at the deadline. We help pick an access point.

Question 19

What is the difference between UBL and Peppol BIS?

Accepted Answer

1. UBL (Universal Business Language) is the message structure: invoice lines, VAT codes, payment terms.
2. Peppol BIS is a UBL variant with extra constraints for uniformity on the Peppol network. Not every UBL is a valid Peppol invoice.
3. The Peppol network connects senders and receivers via access points (think of it like WhatsApp servers between phones). You only need the receiver Peppol ID, not their address.
4. For Dutch government e-invoicing via Peppol or Digipoort is mandatory. For B2B, Peppol is becoming the default.
5. Ask your vendor whether the tool supports "Peppol BIS Billing 3.0", the current international norm.

When to bring us in: 
Non-standard invoice patterns (split-payment, line-level discounts, recurring with variable charges) and Peppol rejects them? Not a blocker but a mapping issue. We can help.

Question 20

Which cookie banner is GDPR and ePrivacy-compliant?

Accepted Answer

1. Categorise cookies. Functional (no consent), analytics (often exempt with a privacy-friendly setup), tracking and marketing (consent required).
2. Do not load tracking cookies or pixels before the visitor clicks. Google Analytics 4 in default setup needs consent.
3. Offer two equivalent buttons: "Accept" and "Reject" or "Only necessary". A grey text link does not equal a big green button.
4. Log proof of consent: timestamp, IP, choice. Users can withdraw; build the option in.
5. Update on every change in cookies or third parties. The AP audits this regularly.

When to bring us in: 
Multi-domain, sub-domains, or tag-manager setups? Solid consent-management implementation is precision work. We have done it.

Question 21

Can I install workplace CCTV?

Accepted Answer

1. Document the purpose. Theft prevention, safety around cash or stock, first-aid response. "Monitoring employees" in general is a red line.
2. Run a DPIA. Workplace CCTV is on the AP DPIA list.
3. Inform employees. Written in the handbook or policy, plus visible signs at entrances. Hidden recording is only allowed under strict conditions, short term, for a concrete incident.
4. Cap retention. AP guidance defaults to a maximum of 4 weeks, longer only with a concrete incident.
5. Check works council (OR). CCTV often needs OR consent under the WOR.

When to bring us in: 
Want facial recognition or AI behavioural analysis on the footage? High-risk under GDPR and the EU AI Act. Do not set up yourself.

Question 22

Can I use software to measure employee productivity?

Accepted Answer

1. Start at purpose. Individual productivity measurement is rarely proportionate; safety or fraud prevention sometimes is.
2. DPIA mandatory. Employees are a vulnerable group due to the dependence relationship.
3. Limit to strictly necessary. Team-level aggregates, anonymous metrics, or strictly event-driven (alarm on suspicious transfers) have a much better chance.
4. Works-council consent is almost always required. Set policy, document what is and is not measured, and what happens with the data.
5. Communicate openly up front. Covert monitoring is hardly defensible in NL outside a documented active investigation with legal counsel.

When to bring us in: 
Tools like Teramind, Hubstaff, or ActivTrak in default configuration clash with most GDPR assessments in NL. Call us before you buy a seat.

Question 23

What is the difference between pseudonymisation and anonymisation?

Accepted Answer

1. Pseudonymisation: names to tokens, emails to hashes, BSN to internal ID. The mapping still exists somewhere. GDPR still applies.
2. Anonymisation: reidentification is reasonably impossible. All linking removed, including indirect (postcode + age + role).
3. Test: can you, with the remaining data plus realistic public info, identify someone? If yes, it is pseudonymous, not anonymous.
4. For analytics on production datasets, pseudonymisation often suffices but the key must be secured separately.
5. For sharing or public release, only real anonymisation is safe. Often k-anonymity or differential privacy is needed.

When to bring us in: 
Unsure whether a dataset is truly anonymous? Treat it as pseudonymous. The AP scrutinises large datasets. We have tooling to verify.

Question 24

A customer or employee asks for access to their data, how do I handle it?

Accepted Answer

1. Identify the requester. An email alone is usually too little; ask for additional proof if identity is unclear. Do not ask for more than strictly needed (do not require an unredacted ID).
2. Search your systems: mail, CRM, ticketing, HR, marketing platform, backups. Note what you found.
3. Deliver securely. Encrypted email, customer portal, or registered post. Not in a plain email.
4. On correction or erasure: propagate to all systems, including processors you forwarded data to. Tell the requester which actions you took.
5. Document the request and your response. The AP can ask for it.

When to bring us in: 
Erasure on a fiscally retained record (invoice, payslip) is tricky. The right to be forgotten yields to statutory retention. Get legal advice before answering.

Question 25

What is the minimum content of my privacy notice?

Accepted Answer

1. Name, KvK, address, and contact of the controller. Plus DPO contact if you have one.
2. Per processing: purpose, categories of data, basis (consent, contract, legal duty, legitimate interest), retention.
3. Categories of recipients. Not every vendor by name, but "payment provider", "cloud provider", "marketing partner" with country.
4. Subject rights and how to exercise them, plus the right to complain at the AP with a link.
5. Last-updated date at the top. Refresh on every material change in tools or purposes.

When to bring us in: 
International transfers, special categories, or automated decision-making? Extra elements are required. Copying a competitor is not enough.

Question 26

I loaded a Meta or LinkedIn pixel without consent, now what?

Accepted Answer

1. Disable the pixel via tag manager or the page template. Verify in the browser console that it is gone.
2. Assess impact: how long it ran, what data was forwarded, to which parties. IP and browsing behaviour already count as personal data.
3. Decide whether this is a breach under GDPR. Unauthorised transfer of personal data can be one. When in doubt: notify as a precaution.
4. Fix your consent-management platform so it cannot recur. Categorise "marketing" explicitly and block scripts until consent.
5. Document what happened and which measures you took. The AP wants exactly this on inspection.

When to bring us in: 
High traffic or sensitive content (health, financial, children)? Get legal counsel involved for the impact analysis.

Question 27

Can I use tracking pixels in marketing emails?

Accepted Answer

1. Check your tool. Mailchimp, Brevo, ActiveCampaign, HubSpot enable open and click tracking by default. Turn it off where not needed.
2. Get consent at sign-up, specified: "May we measure whether you open and click our emails?". Separate checkbox, not pre-ticked.
3. Store consent proof on sign-up (date, IP, chosen options).
4. In every email, an unsubscribe link plus a "tracking preferences" link. Adjustable without unsubscribing is cleaner.
5. For purely transactional mail (order confirmation, invoice) the contract basis applies. Marketing tracking is not in scope of that basis.

When to bring us in: 
B2B with large lists and hand-picked leads? You are in the "soft opt-in" grey zone. Strategy here needs recent case law; we can think along.

Question 28

Minors use our app or service, does consent work differently?

Accepted Answer

1. Determine your basis. Consent for under-16s requires parental consent. Other bases (contract, legal duty) have separate rules.
2. Verify age reasonably. A checkbox "I am 16+" is not reasonable when your audience is demonstrably younger. Combine with payment method or school ID.
3. Verify parental consent if needed: confirmation by email via the parent, or a payment method in the parent name.
4. Adapt the privacy notice to plain language for the audience. Not only legally correct, also readable by a 14-year-old.
5. Limit profiling. Profiling and targeted advertising toward children is strictly limited under EU rules and further bounded by the EU AI Act.

When to bring us in: 
Education or youth-care sector? Extra rules apply (GDPR plus sector). Not DIY.

Question 29

Security incident or data breach, what is the difference?

Accepted Answer

1. Security incident: a disruption or weakness in security. Phishing attempt, failed ransomware, unpatched server. Internal logging, not automatic external notification.
2. Breach: personal data is involved in a loss of confidentiality, integrity, or availability. Ransomware encrypting personal-data files counts. A blocked attempt does not.
3. In doubt? Treat as a breach until proven otherwise. Notifying early is safer than late.
4. Track both categories separately. The incident register supports audits; the breach register is statutory.
5. Train staff on the distinction. People often label something a "breach" that is not, or vice versa.

When to bring us in: 
Active incident with uncertainty about exfiltration? Get CSIRT or forensic advice before you intervene further. Evidence vanishes in half an hour.

Question 30

Whistleblower rules, when mandatory and how?

Accepted Answer

1. Define a reporting procedure: who receives reports, how confidentiality is ensured, within what timelines follow-up happens.
2. Appoint an independent recipient or committee. Someone without interest in the matter. External or an internal role both work.
3. Protect confidentiality. The reporter identity may only be shared with explicit consent or where law requires.
4. Communicate the procedure. Handbook, intranet, annual reminder. Silent policies do not count.
5. Log reports and follow-up anonymously in a register. The labour inspectorate or supervisor can request it.

When to bring us in: 
Receive a report about fraud, financial irregularity, or harassment? Stop on IT and call employment law or forensic investigators. Do not self-handle.

Question 31

Our website has an AI chatbot, what do I need to disclose?

Accepted Answer

1. Open the chat with a clear note "This is an AI assistant". Not buried in the footer.
2. Offer an exit to a human. A "Chat with a colleague" button or a phone number. Pure-AI without a human safety net rarely works.
3. Limit what the bot may promise. No prices, no contractual commitments, no legal advice unless explicitly trained and reviewed.
4. Log conversations. For improvement, complaints, audit. Do not forget the GDPR notice on processing what the visitor types.
5. Add the chatbot to your internal AI register, your processing register, and your privacy notice.

When to bring us in: 
If the bot processes special-category data (health, legal, financial advice), it moves toward high-risk under the AI Act. Not without a DPIA and review.

Question 32

Customer announces a security audit, what do I supply?

Accepted Answer

1. Ask for scope. "Security audit" is broad; request the exact questionnaire (often custom, sometimes SIG/CAIQ).
2. Collect existing artefacts. Certificates, DPA, sub-processor list, security policy, incident response plan, backup procedure, vulnerability report.
3. For gaps, prepare an honest status plus timeline. "ISO 27001 in progress, audit Q3" beats implying something that does not exist.
4. Designate a point of contact for the audit. Not the whole organisation needs access to the Q&A.
5. Keep your own log of what you delivered and when. It saves days at the next audit.

When to bring us in: 
Deep audit with on-site visits or pen-testing rights, and you have never done one? An experienced auditor or consultant in advance is good money.

Question 33

The Dutch DPA announces an investigation, what do I do?

Accepted Answer

1. Read the notification carefully. Which processing, which period, which documents requested. Reply within the stated timeline.
2. Assemble a team: DPO (or deputy), legal, plus the owner of the relevant processing. Not the whole board.
3. Pull together: processing register, DPIA if any, DPAs with processors, privacy notice, security policy, incident register.
4. Answer honestly. This is not an exam scored on perfection; honest about gaps plus action plan beats cover-up.
5. Archive everything you shared and when. Expect a follow-up.

When to bring us in: 
Suspecting a formal order under penalty or an active enforcement procedure? Get legal counsel involved immediately. Not DPO work.

Question 34

Does CSRD apply to my SMB?

Accepted Answer

1. Determine your category. Small, medium, large, or listed SMB based on balance sheet, revenue and headcount per Directive 2013/34/EU.
2. Non-listed SMBs are currently outside direct obligation. Indirectly you still face data requests via large customers.
3. Expect requests from large customers on scope 1, 2 and 3 emissions, energy use, and social indicators. Build that data now, not under pressure later.
4. Track via RVO, EFRAG and the European Commission. Dates in this file shift repeatedly; do not trust old blog posts.

When to bring us in: 
Supplying large multinationals or government? Sustainability clauses will land in contracts. Get a specialist before you sign, not after.

Question 35

Customer requests a "qualified electronic signature", DocuSign says it is signed, is that correct?

Accepted Answer

1. Ask the customer which level they need and on what legal basis. "QES" sometimes means "clear who signed", in which case AdES often suffices.
2. AdES is tied to a verified identity and to the signer (DocuSign Standard with ID-verify, or equivalent flow).
3. QES requires a qualified certificate from a Trust Service Provider. The authoritative list of NL/EU QTSPs is the EU Trusted List (check via the Dutch Ministry of Economic Affairs site or the EU eIDAS Dashboard). Do not trust unverified lists; always pick a provider that is on the Trusted List for the specific service you need.
4. Build the right flow per document type. An employment contract and a quote need not match level; it saves licensing and effort.

When to bring us in: 
For cross-border signing or documents that must stand in court, the AdES vs QES choice is legal, not IT. Bring in a lawyer for scope.

Question 36

How long do I need to keep invoices?

Accepted Answer

1. Retain incoming and outgoing invoices 7 years after the end of the financial year. Statutory, not negotiable.
2. Digital is fine, provided the original (or a conversion where authenticity and integrity are demonstrable) is preserved. Scan a paper invoice and toss the original is allowed, if the scan process is documented.
3. Build retention into the accounting tool or DMS. Delete after 7 years, not earlier, even during "tidy-ups".
4. For VAT on real-estate investments, a 9-year review period plus year of first use applies. Check with your accountant for scope.

When to bring us in: 
International trade can mean longer or country-specific rules. Ask your accountant or a tax advisor; do not guess.

Question 37

I need to draft a DPIA, what is the minimum content?

Accepted Answer

1. Describe the processing concretely: purpose, data categories, subject groups, retention, recipients and any transfers outside the EEA.
2. Test necessity and proportionality. Can you reach the same goal with less data or less invasively? Document why the current setup is the right one.
3. Run the risk analysis from the data subject's perspective, not yours. Think unauthorised access, unwanted linking, profiling or discrimination.
4. Tie measures to each risk: technical (encryption, access control, logging) and organisational (training, policy, contracts).
5. Have the DPO or a privacy lawyer review, get board sign-off, and put a re-assessment date in the calendar.

When to bring us in: 
If you process special-category data at scale or run profiling with legal effects, get a specialist to review before go-live.

Question 38

My vendor uses sub-processors, how do I handle that properly?

Accepted Answer

1. Ask the vendor for the current sub-processor list with country of establishment and what each one does. Keep it with the contract.
2. Agree that the vendor notifies you in advance of any change, with a reasonable window to object.
3. Verify that the prime vendor flows the same obligations down to each sub-processor by contract. Ask for a sample DPA if needed.
4. Watch transfers: if a sub-processor sits outside the EEA, the legal basis (SCCs or EU-US DPF, for example) has to hold for that hop too.
5. Add the chain to your processing register so you can trace where data sat in case of a breach.

When to bring us in: 
If you cannot get a sub-processor list or the vendor refuses notice obligations, that is a red flag. Get a privacy lawyer to review the contract.

Question 39

How do I handle US transfers after Schrems II, with SCCs or the EU-US DPF?

Accepted Answer

1. List vendors that route data outside the EEA. Cloud, email, marketing, support tooling, all candidates.
2. Check whether each vendor is certified under the EU-US Data Privacy Framework. The official list lives at dataprivacyframework.gov.
3. Not certified? Use the European Commission Standard Contractual Clauses and run a Transfer Impact Assessment for that specific flow.
4. Document supplementary measures: encryption in transit and at rest, key management in the EEA, government-request policy.
5. Update your privacy notice so you transparently state which data go where, and on what legal basis.

When to bring us in: 
If you handle special-category data or work for healthcare or government, leaning only on DPF without your own assessment is risky. Get a GDPR lawyer involved.

Question 40

A customer asks for erasure, how do I handle that technically?

Accepted Answer

1. Map where the data live: CRM, accounting, mail archive, backups, support tickets, newsletter tool, analytics. A map per record helps.
2. Check retention obligations. Invoices fall under tax law, complaints often have a limitation period. You may keep what you genuinely need, but document why.
3. Decide per system: hard delete where possible, otherwise structured anonymisation or move to a sealed retention zone.
4. Backups do not get wiped immediately. Document that the data are gone from the primary system and will roll out at the next backup rotation.
5. Confirm in writing what was deleted and what you retain, on what basis, and for how long.

When to bring us in: 
If requests clash with tax or labour-law retention, a GDPR lawyer helps you ground the trade-off.

Question 41

A subject files a DSAR, what do I deliver and in what form?

Accepted Answer

1. Verify the requester's identity before you hand anything over. Ask for the minimum needed; an ID copy with masked national number and photo is acceptable, but only if other verification fails.
2. List every system the person could appear in: CRM, mail archive, tickets, phone logs, marketing tool, HR (for employees), CCTV footage if retained.
3. Deliver in a common electronic format. PDF or CSV works, add context for codes and fields.
4. Include the required info: purposes, categories, recipients (sub-processors and country), retention, source if not collected directly, and subject rights.
5. Carefully redact what you cannot share: data of others, trade secrets, or items covered by a legal exemption. Document what you held back and why.

When to bring us in: 
If the request is tangled with legal disputes or complaints against your company, talk to a lawyer before you reply.

Question 42

Can I send unsolicited marketing email to my customers?

Accepted Answer

1. Existing customer and your own similar product or service? You may email on a customer-relationship basis, provided you offered an easy opt-out at sign-up and in every message.
2. No customer relationship or non-similar offering? You need explicit opt-in, freely given and recorded. Pre-ticked boxes do not count.
3. B2B to business email gets a lighter regime, but opt-out stays mandatory and honouring email-equivalent do-not-contact lists is good practice.
4. Keep consent records: when, via which form, with what wording. The ACM regulator can ask for proof.
5. Test every campaign: does the unsubscribe link work, does opt-out propagate to all systems, not just the marketing tool.

When to bring us in: 
Bulk-mailing purchased lists or via partners puts you outside the rules fast. Run it past legal before you hit send.

Question 43

May I record a customer or employee national service number (BSN)?

Accepted Answer

1. An employer? You may and must process the BSN of employees for payroll and wage tax filings.
2. Supplying healthcare or working in healthcare? BSN inside the care chain is regulated via the Wabvpz law.
3. If you ask BSN for identification or as a customer ID in a normal B2C or B2B context, that is not permitted. Use your own customer number.
4. BSN landing on your desk unsolicited (for example on an ID copy)? Redact it as soon as possible or keep it encrypted only if you genuinely need it for a legal obligation.
5. Record the legal basis for any BSN processing in your processing register. No basis, no BSN.

When to bring us in: 
Unsure if your sector is covered by a specific law that allows BSN, check with your trade body or a GDPR lawyer.

Question 44

We process health or religion data, is that simply allowed?

Accepted Answer

1. Find where special categories appear: sick-leave, catering allergies, union membership, biometrics for access, diversity-survey responses.
2. Pick the right Article 9(2) exception per processing. Sick-leave usually rides on the employment-law exception, with the company doctor as processor.
3. Limit who can see it. Sick-leave does not belong with all of HR, only with strictly needed roles.
4. Document extras: stronger security, shorter retention where possible, and a DPIA if processing is large-scale or structural.
5. Train the people involved in what they may and may not record. The cause of a sick-leave call, for example, often cannot be logged by HR.

When to bring us in: 
Large-scale processing of health, biometric or criminal data is not optional ground for a DPIA and legal review.

Question 45

I invoice the government, what is required for e-invoicing?

Accepted Answer

1. Ask the contracting authority which channel they accept: Peppol BIS Billing 3.0 or Digipoort, and which OIN or Peppol ID to use.
2. Check whether your accounting package supports outbound Peppol. Many packages offer a Peppol button or access-point link for a small monthly fee.
3. Test first with a small invoice or a sandbox. Wrong reference or order numbers get bounced hard by government systems.
4. Make sure your supplier number, order number and any purchase-order number land in the proper UBL fields, not only in the PDF attachment.
5. Record the choice and channel in your admin. On audit you must show you sent the right format to the right recipient.

When to bring us in: 
No Peppol or Digipoort in your tool and you keep winning B2G work? Switching tools or hooking into an access point pays off.

Question 46

We build software or smart devices, does the Cyber Resilience Act hit us?

Accepted Answer

1. Determine if your product is in CRA scope. Software you place on the market commercially and hardware with digital elements typically fall within it.
2. Build a security-by-design dossier: threat analysis, vulnerability handling, secure update mechanism, and an SBOM for your components.
3. Set up a coordinated vulnerability disclosure process with a clear contact channel and an internal SLA for follow-up.
4. Plan product security across the product lifetime. Deliver updates during the support window and clearly inform users when support ends.
5. Track the official timeline via the European Commission. CRA entered into force in December 2024; reporting duty for actively exploited vulnerabilities applies from 11 September 2026, full application from 11 December 2027.

When to bring us in: 
Security and critical products carry stricter requirements. If yours is one, get a specialist to run the conformity assessment.

Question 47

How far can I go with logging and monitoring without bumping into GDPR?

Accepted Answer

1. State the purpose per log source: incident detection, debugging, audit trail. That determines what fields and how long you keep them.
2. Minimise what you log. A user ID is enough; you do not need the full request with personal data. URL parameters with identifiers count as personal data.
3. Set retention to the purpose. Many security logs run weeks to a few months; longer needs justification and a sealed environment.
4. Limit access. SIEM access for a small team, with logs about access itself. Misuse comes from inside more often than you think.
5. State in your privacy notice and staff regulations that you log and why. Silent monitoring is a GDPR and labour-law risk.

When to bring us in: 
If you want to monitor mail content or keystrokes, you cross into GDPR-plus-labour-law turf and need works council consent and a DPIA.

Question 48

How do I tell whether an ISO 27001-certified vendor really has its house in order?

Accepted Answer

1. Ask for the certificate itself, not just the logo. Check that an accredited body issued it and that the version is ISO 27001:2022.
2. Read the scope statement. Does it cover the whole company and the service you buy, or only one office or a different product?
3. Request the Statement of Applicability or a summary. It states which controls apply and which are excluded with justification.
4. Ask whether they have recent audit findings or pen-test reports they will share under NDA. A healthy ISMS has open items; perfection is suspect.
5. Combine the certificate with your own contractual requirements: SLA, security annex, breach notification, audit right where relevant.

When to bring us in: 
High-risk processing or sensitive sectors (health, finance) need more than ISO. Ask additionally for SOC 2 Type II or a NEN 7510 report.

Question 49

How do I make privacy by design and by default practical in my dev process?

Accepted Answer

1. Add a privacy checkpoint to intake and design review: what data, which purpose, which basis, which retention. A short template, not an essay.
2. Privacy-friendly defaults. Fields not pre-filled from other systems, marketing opt-in empty, profiles not public by default.
3. Minimise data in models. Do you really need a birth date or does an age check suffice? Address only where you actually ship.
4. Logging and analytics: use anonymised or aggregated data where possible. Cookieless or server-side analytics avoids a lot of debate.
5. Document the privacy choices in release notes. It helps during DPIAs, audits and later changes by other team members.

When to bring us in: 
Building a product with profiling or automated decision-making? A DPIA up front and a privacy-lawyer review pays off.

Question 50

We run a webshop with reviews or a platform feature, does the DSA hit us?

Accepted Answer

1. Decide what kind of service you provide under the DSA. Pure e-commerce without user content sits mainly under consumer law; reviews, a marketplace or forum makes you an online platform.
2. Set up an accessible notice channel for illegal content. Any visitor must be able to file a notice without an account, with a reason.
3. Give content decisions back to users substantively, with information on internal complaint handling and out-of-court dispute resolution.
4. Be transparent about advertising: who pays, and no targeting on special-category data or on minors.
5. Marketplaces have to do know-your-business-customer for sellers and keep base records. Bake it into the onboarding flow once.

When to bring us in: 
Unsure whether you qualify as an online platform or as a hosting provider, get a specialist IT lawyer to assess the service.

Question 51

What is my cookie banner not allowed to do anymore, in terms of dark patterns?

Accepted Answer

1. Equally prominent. Accept and Reject get the same place, colour and size. No dim-grey Reject next to a vibrant Accept.
2. Equally fast. Reject in one click, not after a detour through a preferences panel where you must un-tick everything.
3. No pre-ticked categories. Statistics and marketing are off until the visitor turns them on.
4. No cookie wall forcing consent to access the site, unless there is an equivalent alternative. The Dutch DPA has clear guidance on this.
5. Keep proof of consent: timestamp, banner version, choice made. On a complaint you must show it.

When to bring us in: 
Facing a DPA investigation or complaint on your banner? Do not self-edit until you spoke with a privacy lawyer. Mid-investigation changes weigh in.

Question 52

We work in healthcare, how heavy is NEN 7510 in practice?

Accepted Answer

1. Decide whether you are a care provider under Wkkgz or Wabvpz, or a supplier to one. Care institutions usually must apply NEN 7510; suppliers follow by contract.
2. Start with a gap analysis against NEN 7510-1 and 7510-2. Most SMB care providers fall short on patient-record logging and formal access reviews.
3. Access to patient data on need-to-know, with logging traceable to the individual employee. Generic accounts and shared passwords are findings.
4. DPAs in order with EHR vendor, hosting and any ICT manager. They process special-category data.
5. Plan an internal audit and, where chain partners ask, external certification. Care institutions vary in what they want to see; ask the customer.

When to bring us in: 
Connections via VECOZO, LSP or regional infrastructures often add chain-level requirements. Align with the connecting party before you build.

Question 53

What audit-trail requirements does NEN 7510 set for patient records?

Accepted Answer

1. Turn on logging in the EHR for view, edit, export, print and share. Anonymous or shared accounts have to go, otherwise the logs are worthless.
2. Keep logs long enough to support sampling reviews. Confirm the right retention via the NEN 7510 text and your internal risk analysis, not by heart.
3. Build in periodic log review. A monthly random sample focused on flagged views (own family, public figures, ex-colleagues) is common practice.
4. Secure the logs themselves. Read-only storage, restricted access, and logging on who consults the logs.
5. Document the process. Who reviews, how often, which escalation on suspicion, and how you inform subjects when their record was viewed unlawfully.

When to bring us in: 
Suspected unlawful access or a breach involving patient data demands immediate notice to the DPA, the DPO and possibly IGJ. Call in support.

Question 54

We fall under Wwft, what does that mean for our IT?

Accepted Answer

1. Implement an ID-and-V process. Verify customer identity from a reliable source, captured in a file traceable per natural person and ultimate beneficial owner.
2. Set up transaction monitoring. Rules on anomalous patterns, escalation to the compliance officer, and a steady way to report unusual transactions to FIU-Nederland.
3. Retention. Wwft sets its own retention for client data and transactions; read the live text, not memory, for the exact period.
4. Logging and authorisation. Not everyone gets at Wwft files, and actions must be logged. Combine with your GDPR requirements.
5. Run a SIRA (systematic integrity-risk analysis) regularly and update IT controls on the back of it. DNB and BFT expect a living process, not a one-off document.

When to bring us in: 
Crypto service providers and trust offices have extra regimes. Do not store those guidelines from memory; check with your supervisor or compliance lawyer.

Question 55

We supply algorithms or AI models to government, what about the algorithm register?

Accepted Answer

1. Ask the customer which fields the contracting authority publishes. Purpose, mechanism, risks, evaluation and governance are typical asks.
2. Deliver a readable model card: purpose, inputs, outputs, limitations, how it was trained, how it is monitored and known risks.
3. Document who is accountable for maintenance, retraining and decommissioning. The government wants a contact and a process, not a black box.
4. Cross-reference EU AI Act. A high-risk system under the AI Act carries extra documentation duties that often overlap with the register.
5. Schedule an annual review of the registration with the customer. Models drift, the register has to follow.

When to bring us in: 
Building systems that decide on citizens' rights or services? An independent ethical and legal review is more than a formality.

Question 56

A customer wants their data corrected, how do I handle that across systems?

Accepted Answer

1. Pick the source system per data type. Address usually lives in CRM or HR, not scattered across mail templates and stray spreadsheets.
2. Update at the source and let downstream systems sync. Not via monthly export-import, but via API or scheduled sync.
3. Make derivatives visible. Reports, data warehouse, BI. Document whether correction propagates or comes through on next refresh.
4. Confirm in writing what changed, in which systems, and which recipients (sub-processors, partners) you notified.
5. Stick to the GDPR deadline: without undue delay, at most one month. Extend once by two months for complex requests, with reasoning.

When to bring us in: 
If your landscape is heavily fragmented without a master-data source, this is not an ad-hoc fix. Plan a master-data project.

Question 57

A customer sends us a NIS2 vendor questionnaire, how do I fill it in smartly?

Accepted Answer

1. Read the whole questionnaire first. Map which topics (ISMS, incident response, access control, BCM, vendor management) and at what depth.
2. Collect evidence internally. Policy, ISMS scope, recent pen test, breach procedure, sub-processor contracts, awareness training. You reuse this every time.
3. Answer honestly. A No with a roadmap beats a Yes without evidence. Customers probe and discrepancies hurt at audit.
4. Keep a central NIS2 vendor file. A managed version of the most-asked answers saves time every round.
5. Ask the customer which topics they prioritise. Sometimes only the incident-notification deadline is the cornerstone and the rest can be a growth path.

When to bring us in: 
If a question keeps coming back that you cannot honestly answer without an audit, be transparent and propose a joint follow-up.

Question 58

DORA requires a register of ICT third parties, how do I support that?

Accepted Answer

1. Per service deliver at minimum: your entity data (name, KvK, LEI if available), service description, data and staff location, sub-providers and concentration with other vendors.
2. Mark whether your service is critical or important to the customer. The classification is theirs, but your input on outage impact helps.
3. Align contracts to DORA requirements: incident notification windows, audit rights, exit plan, data portability, sub-outsourcing rules. Many financial customers send DORA addenda.
4. Build a change process. Changing a sub-processor, hosting country or security baseline must reach the customer's register in time.
5. Test a DORA incident scenario with a major customer once. It exposes where reporting and channels fall short.

When to bring us in: 
If your service is marked critical for multiple financial entities, you will not solve the extra expectations alone. Bring in a DORA specialist.

Question 59

How do I tell which EU AI Act category our AI use case falls in?

Accepted Answer

1. Start with the exclusions. Prohibited practices such as government social scoring or certain biometric identification are banned from February 2025 in the EU.
2. Check the high-risk annexes. Hiring, access to education, credit scoring, critical infrastructure and some law-enforcement tools typically land here.
3. Limited risk. Chatbots, generated content (deepfakes) and emotion recognition mostly require user-facing transparency.
4. GPAI models. Providers of general-purpose AI models get specific documentation and transparency duties under the AI Act from August 2025.
5. Document the classification and the rationale. When in doubt go stricter until the regulator clarifies your case.

When to bring us in: 
Building something tilting towards high-risk with direct effects on people? An AI Act lawyer plus DPIA is not optional.

Question 60

How do I choose scope and plan the runway for an ISO 27001 project?

Accepted Answer

1. Set scope based on what you sell and to whom. For a SaaS SMB that is usually the product, the team building it and supporting processes, not the whole legal entity.
2. Run a gap analysis against ISO 27001:2022. It covers governance, policies, risk management, people, physical security, technical controls and vendor management.
3. Plan in two phases. Build the ISMS first and let it run in practice for at least a few months. Then schedule the stage 1 audit with the certifying body.
4. Expect several months up to roughly a year for first certification, depending on maturity and team bandwidth. No exact guarantee; ask an external party to scope your situation.
5. Plan annual recertification and internal audits in from day one. An ISMS that stalls after audit fails the next round.

When to bring us in: 
Limited internal capacity? An external ISMS coach for the first cycle pays off. Not to do everything, but to put you on the rails.

Question 61

We want to monitor employee activity, what about works council and CLA?

Accepted Answer

1. Define purpose and means. Productivity, security or fraud detection, and what minimal means achieves it? That purpose lands in policy and privacy notice.
2. Run a DPIA. Employee monitoring is structural and large-scale by definition, so risks to subjects must be assessed.
3. Get works-council consent under WOR article 27 for the personnel-tracking system. No consent, no rollout.
4. Check the CLA. Some collective agreements add requirements or ban specific monitoring; read them or ask your employer's organisation.
5. Communicate to staff. A staff regulation with clear wording on what is monitored, why, and what rights employees have belongs in the package.

When to bring us in: 
Targeted monitoring of an individual employee (suspected fraud, for example) needs legal advice and evidence strategy up front.

Compliance and regulations