← All resources

NIS2 Netherlands: are webshops and marketplaces in scope?

Published November 1, 2026 · 8 min read · CyberNovaLabs.io

Dutch law does not target "e-commerce". It targets three digital services, one of which is online marketplaces. Here is the exact test, the real obligations, and what still catches a webshop that is out of scope.

The short answer

No, not for an ordinary webshop. The Cyberbeveiligingswet (Cbw) implemented NIS2 in the Netherlands on 15 August 2026 and sets requirements for roughly 8,000 essential and important entities^[1][4]. For e-commerce, however, Annex 2 of the Act lists only three categories of digital providers: providers of online marketplaces, of online search engines, and of social networking platforms^[2]. Selling your own products on your own site does not put you in that scope.

What flips the answer is opening your catalogue to third-party sellers. The Cbw defines an onlinemarktplaats as a service using software — a website, part of a website, or an application operated by or on behalf of a trader — that enables consumers to conclude distance contracts with other traders or consumers^[2]. The decisive word is "other". As long as you are the only seller, the service is not a marketplace.

NIS2 Netherlands: are you in scope? Two filters

Two conditions, cumulative. Both must be true.

Filter 1 — the nature of the service

• You sell only your own goods or services, even at EUR 40 million a year: out of scope under Annex 2.
• Third-party sellers conclude contracts through your interface — marketplace, B2B trading platform, any model where the third party remains the legal seller: in scope, to be assessed.
• You build, host or manage other people's shops: your category is not "online marketplace" but managed ICT services, cloud or data centre services^[2]. That reasoning is worked through in our guide to NIS2 in the Netherlands for software vendors and IT providers.

Filter 2 — size

The NCSC states the Dutch threshold as follows: 50 employees (FTE) or more; or fewer than 50 employees but both annual turnover and balance sheet total above EUR 10 million^[5]. Mind the arithmetic: partner and linked enterprises — parent company, subsidiaries — count towards headcount, turnover and balance sheet^[5]. A marketplace that clears both filters is an important entity (belangrijke entiteit), not an essential one: the Annex 2 digital providers are not listed among essential entities^[2].

What Dutch law actually requires of a marketplace

Three duties — register, take measures, report — and four bodies that are easy to mix up.

1. Register, and register twice

First there is the national entity register (Articles 43 to 46 Cbw), filed through MijnNCSC. Then there is a duty specific to digital providers: Article 47 Cbw requires providers of online marketplaces to supply information to the central contact point for the ENISA register^[2]. Two filings, not one.

The operational detail that delays everyone: MijnNCSC is accessed with eHerkenning at assurance level EH2+ plus an authorisation, tied to the KvK number of the registering organisation — and the request can take several days. The form asks for public IP addresses or ranges, domain names and AS numbers (ASN)^[9].

2. Take the measures (zorgplicht, Article 21 Cbw)

The NCSC breaks Article 21 into ten measures: risk analysis, incident response, continuity and backups, supply chain security, cyber hygiene and training, securing systems including patch management and a contact point for vulnerability reports, personnel, access and asset management, authentication, cryptography policy, and periodic assessment of how well the measures work^[8].

Two points are more prescriptive than the European average. First, the NCSC explicitly recommends passkeys (the FIDO2 standard) instead of passwords, with multi-factor authentication wherever passwords remain^[8]. Second, Article 24 Cbw requires the measures to be approved by the management body, and every member of that body to have the knowledge and skills to identify risks and assess risk-management measures^[2].

3. Report significant incidents

A single filing on MijnNCSC reaches both your sectoral CSIRT and your supervisory authority^[7]. The clocks start when you become aware of the incident.

Minor incidents and near misses can be reported voluntarily: those filings go to the CSIRT only, not to the supervisory authority^[7].

Who does what, and what a breach costs

That is the split published by the NCSC for the digital providers sector, and the Cbw names the Minister of Economic Affairs as competent authority for it^[6][2]. Sector-specific criteria and reporting thresholds are set out by the responsible ministry^[13].

The fines sit in the Act itself. For an important entity: up to EUR 7 million or 1.4% of the group's total worldwide annual turnover in the preceding financial year, whichever is higher, for breaches of Articles 21, 21a and 25 to 30; EUR 1 million for any other breach^[2]. And a provision that is routinely overlooked: Article 93 Cbw allows a fine of up to EUR 25,000 to be imposed on an individual member of the management body for breaching Article 24, paragraphs 2 to 6^[2]. Director-level competence is not boilerplate here.

Why a Dutch webshop should care anyway

The market leans on too few links to treat security as a compliance topic. In the first half of 2026 Dutch consumers made more than 170 million online purchases, 3% more than a year earlier, worth EUR 17.1 billion in near-flat spending, at an average of EUR 100 per order, down 3%^[12]. Two figures matter more than the rest for your attack surface: 45% of purchases are made on a smartphone, and iDEAL|Wero accounts for 73% of the number of online purchases^[12]. A tampered checkout page or a compromised admin account therefore hits the channel that carries most of your revenue.

A third figure is useful if you sell across the border: 14% of Dutch online purchases are made at a foreign webshop^[12]. If you sell into the Netherlands from France or Belgium, your Dutch customers' security expectations arrive long before any question of legal scope — the same reflex we describe in our guide to prospecting and B2B appointment setting in the Netherlands.

The first five actions

1. Settle your status in writing, today. One page is enough: what you actually sell, whether third-party sellers conclude contracts through your site, both size tests with this year's figures, the date you checked, and the source (Annex 2 Cbw, Staatsblad 2026 No. 187). That is the document you hand over at the next customer questionnaire, without redoing the analysis.
2. If you are in scope, start eHerkenning EH2+ before anything else — it is the long pole. In parallel, gather your public IP ranges, domain names and AS numbers, then complete the MijnNCSC form in one sitting^[9]. Do not forget the second filing, for the ENISA register^[2].
3. Write the 24-hour / 72-hour / one-month procedure with a name, a deputy and a phone number, and run it once as a dry run: who decides an incident is "significant", who files on MijnNCSC, who tells customers and third-party sellers.
4. Move your administrative accounts to passkeys — back office, hosting, DNS, shipping mailbox, payment service provider — and publish a vulnerability reporting address. Both are explicitly asked for by the NCSC^[8].
5. Interrogate your suppliers. Hosting provider, e-commerce agency, PSP, carrier: which of them fall under the Cbw themselves, how fast will they tell you about an incident on their side, and what does the contract say? That is measure 4 of the zorgplicht^[8].

At CyberNovaLabs.io

We always start with the scope question, because a written answer takes half a day and saves months of unnecessary compliance. To make a first pass yourself, use our free NIS2 check, then the country page NIS2 in the Netherlands, which sets out authorities, deadlines and sectors. If the pressure comes from a customer rather than a regulator, what you need is our supplier security questionnaire pack. And if the workload is the real problem, look at our AI and automation for business offer.

We work in the Netherlands, Belgium, France and Luxembourg, in Dutch, French and English. Tell us your model — own-stock selling, marketplace, or both — and we will give you a written, sourced position you can put in front of a customer. Tell us about your situation.

Sources

1. NCSC — Cyberbeveiligingswet (NIS2)
2. Cyberbeveiligingswet, texte en vigueur depuis le 15-08-2026 (wetten.overheid.nl)
3. Staatsblad 2026, 187 — Cyberbeveiligingswet (loi du 8 juillet 2026)
4. Rijksoverheid — Cyberbeveiligingswet et Wet weerbaarheid kritieke entiteiten en vigueur au 15 août 2026
5. NCSC — Valt mijn organisatie onder de Cyberbeveiligingswet (NIS2)?
6. NCSC — Toezicht op de Cyberbeveiligingswet: hoe zit dat?
7. NCSC — Meld incidenten onder de Cyberbeveiligingswet (meldplicht)
8. NCSC — Zorgplicht: de tien maatregelen van artikel 21 Cbw
9. NCSC — Registreer jouw organisatie (MijnNCSC, eHerkenning EH2+)
10. RDI — NIS2-zelfevaluatie (regelhulpen voor bedrijven)
11. ACM — Handreiking Digital Services Act voor webwinkels en marktplaatsen
12. Thuiswinkel.org / NielsenIQ — Thuiswinkel Markt Monitor, premier semestre 2026
13. NCTV — Sectorspecifieke informatie Cyberbeveiligingswet

Read next