Cybersecurity Policy Report, New Cyber Laws Enter Into Force in Netherlands, (Aug 17, 2026)

By Tony Foley

The Dutch National Cyber Security Centre (NCSC) announced over the weekend that two new laws that strengthen the digital and physical resilience of the Netherlands and impose additional requirements on organizations had taken effect.

NCSC’s news release said the Cybersecurity Act (Cbw) and Critical Entities Resilience Act (Wwke) each came into force on Saturday. The Cbw implements European Union Directive 2022/2555, commonly referred to as the NIS2 Directive, which establishes the EU’s updated cybersecurity framework. It requires organizations to register with the National Entities Register, take appropriate measures to manage the risk to the security of their networks and information systems, prevent incidents or limit their consequences, and report significant incidents within statutory time limits, among other requirements.

The Wwke implements the European Critical Entities Resilience Directive, which covers “critical entities” providing essential services and concerns resilience against various threats and risks like natural disasters, accidents, sabotage, and terrorist offenses. The NCSC explained that, while all organizations designated as critical entities under the Wwke were automatically classified as essential entities under the Cbw, the reverse was not true, meaning that essential entities under the Cbw would not necessarily be considered critical entities under the Wwke.

Under the Wwke, critical entities must conduct risk assessments, take appropriate resilience measures, report significant incidents, and comply with the Wwke’s other obligations.

News: InternationalLegislation DataSecurity DataBreach DataPrivacy