Due diligence in a Dutch technology acquisition must answer three questions a financial audit does not: does the target own its code and intellectual property, does its software carry open-source obligations, and can its data processing withstand a regulator. Two Dutch gates may apply before completion: notification under the Investment, Mergers and Acquisitions Security Screening Act (Wet Vifo) if the target works with sensitive technology, and merger notification to the Netherlands Authority for Consumers and Markets (ACM) if the turnover thresholds are met.
Most value lost in failed tech deals comes from a few recurring defects: founder or contractor IP that was never transferred, copyleft code inside a proprietary product, customer contracts that end on a change of control, and data processing that cannot be defended. Each of them can be found before signing. For the wider framework, see our overview of Hollandiyada birləşmələr və satınalmalar.
Mündəricat
Does the target really own its intellectual property?
Usually for work by employees, often not for work by contractors and founders. Check the chain of title for every piece of core code and every registered right.
Under Article 7 of the Dutch Copyright Act (Auteurswet), the employer is regarded as the maker of works an employee creates in the course of employment, unless agreed otherwise. Code written by staff therefore normally belongs to the company. For patents the rule is narrower: under Article 12 of the Patents Act 1995 (Rijksoctrooiwet 1995) the employer is entitled to an employee’s invention only where the nature of the job involves making inventions of that kind.
Contractors and freelancers keep the copyright unless it has been transferred, and under Article 2(3) Auteurswet a transfer must be agreed in writing. An invoice, an e-mail or a general clause in a purchase order is not enough. The same gap arises where a founder wrote a key algorithm before the company existed.
What should the IP schedule contain?
- registered rights: patents, trademarks and designs with numbers, jurisdictions and owners;
- unregistered assets: source code, algorithms, trade secrets and how they are kept confidential;
- written IP transfers from founders, contractors and agencies that built core components;
- licences in and out, including exclusivity and change-of-control clauses.
Does the codebase carry open-source risks?
Often. Copyleft licences such as the GNU General Public License (GPL) can require that software distributed with the licensed code is released under the same licence, which can undermine the value of a proprietary product.
Have the code scanned with a specialised tool and obtain a software bill of materials (SBOM) listing every component and licence. Ask how the target distributes its software: for software offered only as a service, some copyleft licences have less effect than for software that is distributed, while others (such as the AGPL) also cover network use.
Can the target’s data processing and security withstand scrutiny?
Ask for the GDPR documentation and the security file before signing. Gaps found later become the buyer’s problem.
- the record of processing activities, data protection impact assessments (DPIAs) and the lawful basis for each processing purpose;
- data processing agreements with customers and suppliers, and transfers outside the EU;
- past data breaches and whether they were notified to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens);
- penetration tests, ISO 27001 or SOC 2 reports, checking the scope of each certificate;
- whether the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, applies, and if so whether the target is registered and can meet the incident deadlines of 24 and 72 hours.
Which commercial and employment risks are easily missed?
Change-of-control clauses, customer concentration and the position of key staff. These do not show up in a code scan but can remove much of the value on day one.
Customer and supplier contracts
Review all major contracts for change-of-control and termination rights, exclusivity, most-favoured-customer clauses and liability caps. If one customer generates a large share of revenue, check the term and renewal of that contract in detail. See also our article on SaaS müqavilələrinin və məlumat sahibliyinin gizli riskləri.
Key staff and contractors
Under Article 7:653 of the Dutch Civil Code (BW), a non-compete clause is valid only if agreed in writing with an adult employee; in a fixed-term contract it also needs a written statement of the employer’s compelling business interests. The court can set aside a clause that unfairly disadvantages the employee. Clauses copied from a foreign group template often fail these tests.
Also check whether developers engaged as contractors are in reality employees. Since 1 January 2025 the Belastingdienst enforces fully against false self-employment, and from 31 December 2026 a worker paid at or below a statutory hourly rate is presumed to be an employee (Article 7:610aa BW). A buyer inherits that exposure in a share deal.
Which Dutch regulatory gates apply before completion?
Investment screening under the Wet Vifo and merger control under the Competition Act (Mededingingswet). Both can delay or block completion, so check them at the start of the process.
Does the Wet Vifo apply?
The Wet Vifo applies to acquisitions of, among others, vital providers and companies active in sensitive technology. Under Article 8 of the Act, sensitive technology includes dual-use items that require an export licence under EU Regulation 2021/821, and the category has been extended by decree to further technologies.
Every intended acquisition within scope must be notified to the Minister of Economic Affairs (Article 11), and it may not be completed before the minister has confirmed no review is needed or has taken a review decision (Article 10). Under Article 28, an acquisition completed in breach of a prohibition can be null and void or voidable, and the minister can order the parties to undo it. Include a Vifo check in the first round of due diligence and make clearance a condition precedent.
Is ACM merger notification required?
Under Article 29 of the Competition Act, a concentration must be notified to the ACM if the combined worldwide turnover of the undertakings concerned exceeded €150 million in the previous calendar year and at least two of them each achieved at least €30 million in the Netherlands. Above the EU thresholds, the European Commission is competent instead.
Which tax points should the tax adviser check early?
Law & More does not give tax advice, but the legal documents should reflect what the tax review finds. Typical points in Dutch tech targets are the expatriate scheme (30% ruling) for staff recruited abroad, the WBSO payroll tax reduction for research and development administered by RVO, and transfer pricing where valuable IP sits in an entity with little substance. Agree with your tax adviser which findings need a specific indemnity.
How do you turn findings into protection in the purchase agreement?
Through the price, warranties, specific indemnities and conditions precedent. Each known defect should end up in one of these.
- Qiymət tənzimlənməsi for quantified issues such as technical debt or higher churn than reported.
- Specific indemnities for known risks, for example a pending IP claim, an unreported data breach or a contractor reclassification.
- Presedent şərtlər such as a signed IP transfer from a founder, Vifo clearance or ACM approval.
- Garanti on IP ownership, open-source compliance, data protection and security, with disclosure against them.
- Qazanc where valuation depends on growth, with objective metrics such as annual recurring revenue.
Under Dutch law, a buyer who did not investigate may lose a later claim because of its duty to investigate. A documented due diligence process and clear warranties limit that risk. For general principles, see our articles on Hollandiyada lazımi araşdırmalar və legal risks in Dutch M&A due diligence.
Alıcı olaraq nəyi yoxlamalısınız?
- Written IP transfers from every founder, contractor and agency that built core code (Article 2(3) Auteurswet).
- A software bill of materials and the open-source licences in it.
- Change-of-control clauses in the main customer and supplier contracts.
- Whether the Wet Vifo or ACM notification applies, and the timing it adds.
- Contractor relationships that could be reclassified as employment.
- Data breaches, GDPR documentation and Cybersecurity Act status.
Satıcı olaraq nəyi yoxlamalısınız?
- Whether all IP transfers are signed in writing before the data room opens.
- Whether your open-source use is documented and compliant.
- Which contracts need consent from the other party on a change of control.
- Whether your disclosure letter covers every known issue, to limit warranty claims.
- Whether caps, thresholds and time limits on warranty claims are acceptable.
What can we do for you with a tech acquisition?
Bizim korporativ vəkillər act for buyers and sellers in technology transactions.
- We set up and run the legal due diligence and report the findings by risk level.
- We review the IP chain of title and draft confirmatory IP transfer agreements.
- We assess whether a Wet Vifo or ACM notification is required and prepare it.
- We draft and negotiate the purchase agreement, warranties, indemnities and earn-out.
- We review employment contracts, non-competes and contractor arrangements of key staff.
xülasə
- Employee-created copyright normally belongs to the employer (Article 7 Auteurswet); contractor and founder IP needs a written transfer.
- Copyleft licences and missing SBOMs are a common hidden risk in proprietary software.
- A Wet Vifo notification and standstill may apply; completion in breach of a prohibition can be void or voidable (Article 28).
- ACM notification applies above €150 million combined turnover with two parties each at €30 million in the Netherlands.
- Translate each finding into a price adjustment, indemnity, condition precedent or warranty.
Tez-tez soruşulan suallar
How do we deal with code a founder wrote before incorporation?
Make a written IP transfer from the founder to the company a condition precedent to completion. Under Article 2(3) Auteurswet a transfer of copyright must be agreed in writing; a verbal promise is not enough.
What is the most overlooked risk in early-stage tech deals?
Developers engaged as contractors who in practice work as employees. In a share deal the buyer inherits the payroll tax exposure and possible employment claims, and from 31 December 2026 the hourly-rate presumption of Article 7:610aa BW adds to that risk.
How can technical debt be reflected in the deal?
Have the technical team estimate the cost of bringing the code to a maintainable standard. That figure can support a price reduction, a specific indemnity or an earn-out.
Does every tech acquisition need a Wet Vifo notification?
No. It applies to targets that are vital providers, operate a business campus or work with sensitive technology as defined in the Act. Check this early, because completion before clearance is not allowed.
