Compliance

Compliance is the process by which an organisation ensures that all its activities comply with applicable laws and regulations, industry standards and internal policies. It encompasses both legal obligations, such as the General Data Protection Regulation, and agreements with clients, suppliers and regulators. For Dutch SMEs, compliance means structuring your processes, systems and communications in such a way as to minimise the risks of fines, claims and reputational damage.

How compliance works in practice

Compliance begins with identifying which rules apply to your company. These include privacy legislation, employment law, tax obligations and sector-specific standards such as the Market and Government Act for public procurement. You then translate those rules into concrete work processes: who does what, when, and how do you document this? For example, an online shop must be able to demonstrate that customer data is stored securely, that consent for newsletters has been obtained correctly, and that the returns policy has been clearly communicated. Compliance requires documentation, regular checks and a culture in which staff know what is and isn’t permitted.

Why compliance is more urgent now than it was ten years ago

In recent years, legislation and regulations have been significantly tightened. In 2018, the GDPR introduced fines of up to 20 million pounds or 4 per cent of global turnover. Since then, the Dutch Data Protection Authority has imposed hundreds of fines, including on small and medium-sized companies. At the same time, customers and business partners are setting higher standards: those without a privacy statement or accessibility statement are losing contracts. Compliance has shifted from a mere legal formality to a prerequisite for even being allowed to participate in tenders, partnerships and online marketing.

What compliance delivers for your company

Those who manage compliance properly not only avoid fines but also build trust. Clients feel more secure when you are transparent about data processing. Employees know where they stand when terms of employment are clearly set out. And in the event of an audit or a claim, you can demonstrate that you have acted with due care. In practice, we see that companies which take a systematic approach to compliance spend less time dealing with ad-hoc issues and experience greater peace of mind. A well-thought-out SEO strategy, for example, can only be successful if your website complies with cookie legislation and accessibility requirements; otherwise, you’ll be holding back your own growth.

Compliance affects virtually every aspect of your company's operations. From the way you store customer data to how you instruct staff on working safely. Below are four specific areas where compliance has a direct impact on your day-to-day operations and where SMEs regularly encounter issues.

Privacy compliance and data protection

Any organisation that processes personal data must comply with the GDPR. This means: an up-to-date privacy policy on your website, a data processor register in which you keep track of what data you collect and why, and technical measures such as encryption and access control. An online shop with 500 products and 2,000 customers per year must be able to demonstrate that payment details are transmitted securely, that customers can view or have their data deleted, and that only authorised staff have access to the database. Privacy compliance requires a combination of legal documentation and technical infrastructure, for example through a well-secured managed WordPress hosting service with automatic backups and SSL certificates.

Financial compliance and tax obligations

Companies must comply with accounting rules, VAT legislation and annual accounts obligations. For online shops selling internationally, cross-border VAT is also a factor, with different rates and reporting rules for each country. A B2B service provider with 12 employees must correctly pay payroll taxes, keep track of UWV contributions and submit annual payroll returns. Financial compliance often means that your records and systems must be in order: invoices must meet legal requirements, payments must be traceable and records must be retained for seven years. Many SMEs link their accounting software to their online shop or CRM system to prevent manual errors.

Accessibility and inclusive design

Since 2020, government websites – and from 2025 onwards, many commercial websites too – must comply with the accessibility requirements set out in the European Directive. This means that your website must be usable by people with visual, hearing or motor impairments. Specifically: sufficient colour contrast, keyboard navigation, subtitles for videos and alt text for images. A local authority or healthcare organisation issuing tenders checks whether suppliers have an accessibility statement. Compliance in this area requires conscious design choices and regular audits, but also delivers a better user experience for all visitors.

When compliance is the right priority and when it isn’t

Compliance is urgent if you work in a regulated sector (healthcare, finance, public sector), process personal data or operate internationally. In such cases, the risks of non-compliance are too great to ignore. For a sole trader with no customer data or a creative agency that only provides services to established clients, the urgency is lower but not non-existent. You are always subject to employment law, tax obligations and general terms and conditions. The mistake many companies make is viewing compliance as a one-off project rather than an ongoing process. Laws and regulations change, your company grows, and new services bring with them new obligations. It is better to build compliance into your work processes and review it annually.