Does the Netherlands have a data retention law for hosting providers?

What did the Dutch court decide on 11 March 2015?

The judge in summary proceedings at the District Court of The Hague put the Telecommunications Data Retention Act out of force. Privacy First and six other claimants had sued the State.

The act made providers of telephone and internet services store traffic and location data on every user. Telephony data stayed 12 months. Internet access, email and internet telephony data stayed 6 months.

The judge applied the Court of Justice ruling of 8 April 2014, which voided the EU directive behind the act. Three flaws decided the case:

• It covered everyone, with no link to serious crime.
• Prosecutors could open the data without prior review by a court or an independent body. The judge held that the public prosecutor is not such a body.
• Nothing required the data to stay inside the EU.

The 2015 ruling removed the Dutch duty to keep everyone's telecom traffic data in advance, and no law has replaced it.

Where does Dutch bill 34537 stand?

Bill 34537, "aanpassing bewaarplicht telecommunicatiegegevens", reached the House of Representatives on 12 September 2016. It keeps the old periods: 6 months for internet data, 12 months for telephony. A prosecutor would need the approval of an examining judge (rechter-commissaris). Providers would have to store and process the data inside the EU.

MPs filed their written report on 3 November 2016. The House page, read on 1 November 2026, still lists the bill as awaiting the government's memorandum in reply. Debate and vote have not happened.

The justice committee declared it controversial in 2017 and 2021, then chose not to on 19 June 2025. Whether the government will revive it or wait for EU rules is unclear.

Does a Dutch hosting provider have to keep logs?

No statute requires it. Bill 34537 would cover providers of public telecommunications networks and services only. Renting a server is a hosting service.

EU law also sets a ceiling. The Court of Justice settled it in La Quadrature du Net on 6 October 2020. Under Article 23(1) of the GDPR, no national law may make hosting service providers retain personal data generally and indiscriminately. That ruling binds the Netherlands as an EU member state.

Many search results answer another question: how long a company must keep its books. That is tax law, not traffic data.

This page explains published law and court rulings; it is not legal advice.

Which Dutch orders can still reach a host?

Orders that reach data a provider already holds. The Code of Criminal Procedure, in the version in force since 1 July 2026, gives prosecutors and police these tools:

• Article 126n: for serious offences, a prosecutor can order any provider of a communication service to supply data on a user and their traffic. The order covers data held now, or processed over the next 3 months at most.
• Article 138g defines that provider widely. It includes anyone who processes or stores data for such a service or its users, so a host can receive the order.
• Article 126na: for any crime, an officer can ask for a user's name, address, number and type of service.
• Article 126nd: a prosecutor can order anyone believed to have access to stored data to hand it over.
• Article 126ni: a prosecutor can order stored data kept and available for up to 90 days when it risks loss or change.

A Dutch order can freeze or copy what a host holds; it cannot produce records the host never kept.

What changed with the EU e-Evidence rules in 2026?

Regulation (EU) 2023/1543 applies from 18 August 2026. A judicial authority in one member state can now order a service provider in another to produce or preserve electronic evidence.

The regulation defines that evidence as data stored when the order is received. It creates no duty to collect data in advance.

• Subscriber data and IP addresses needed to identify a user can be ordered for any criminal offence.
• Traffic and content data need an offence punishable by at least three years, or a listed offence committed through an information system.
• Deadlines: 10 days to produce the data, or 8 hours in an emergency.

How the regulation reaches a provider based outside the EU is covered on can police seize my server in another country.

Will the Netherlands bring data retention back?

No date exists. The European Commission's data retention page, read on 1 November 2026, says no EU-wide framework is in place. The Commission began an impact assessment on new EU rules in May 2025.

A European Parliament briefing of July 2025 says the Netherlands backs a new EU-wide regime, despite inaction at home. Neither gives a Dutch timetable.

The court limits that any new law must respect, country by country, are on which European countries still have data retention laws.

What does Ravenquay keep about an Amsterdam server?

Only what billing and running the server need. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country. In Amsterdam, that means Dutch law governs the datacenter, its network and its building.

In Ravenquay's survey of 34 dedicated-server hosts on 30 October 2026, 19 offered machines in the Netherlands: the largest count of the four Ravenquay countries. Compare the Swiss rules on does Switzerland have a data retention law for hosting providers.