Netherlands VPS & offshore servers.
EU rules, connectivity first.

Legal profile

EU status

Founding member of the EU

Digital Services Act

Applies; the ACM is the Digital Services Coordinator

Data protection

GDPR, with the Dutch implementation act (UAVG)

Traffic data retention

No general duty since a 2015 court ruling

Press freedom

2nd of 180 (RSF, 2026)

The Netherlands is a founding member of the EU, and the Digital Services Act applies in full. The Authority for Consumers and Markets (ACM) is the national Digital Services Coordinator (European Commission). Article 7 of the Constitution rules out any requirement of prior permission to publish, and RSF ranks the country 2nd in 2026, while noting threats from organized crime against reporters.

Copyright and enforcement

Dutch rights holders are well organized. A case brought by the anti-piracy foundation BREIN led the EU Court of Justice to rule in 2017 that operating a platform such as The Pirate Bay is itself a communication to the public under EU copyright law (C-610/15, Stichting Brein v Ziggo). Hosting providers receive notices under the DSA's notice-and-action rules: a valid notice explains why the content is illegal and where it is, and gives the host actual knowledge; the host must then decide diligently and give the customer a statement of reasons if content is restricted (DSA, Articles 16 and 17).

Criminal law adds a targeted tool. Under Article 125p of the Code of Criminal Procedure, a public prosecutor can order a communication service provider to make specific data inaccessible to end an offense or prevent new ones, but only with prior written authorization from an examining magistrate, who must give the provider a chance to be heard. The provider must keep the order confidential.

Dutch authorities also act against abusive infrastructure directly. In February 2025 police took 127 servers of the "bulletproof" host Zservers/XHost offline (BleepingComputer). In November 2025 they seized about 250 servers of another such service (BleepingComputer). In May 2026 the financial crime investigation service FIOD seized 800 servers and arrested two people in a case about a hosting company suspected of supporting EU-sanctioned Russian and Belarusian entities (BleepingComputer).

Data protection and retention

The GDPR applies directly, supplemented by the Dutch GDPR Implementation Act (UAVG). The supervisory authority is the Autoriteit Persoonsgegevens. Personal data processed in Amsterdam stays inside the EU.

The Dutch Telecommunications Data Retention Act once required telephone and internet providers to store their users' traffic and location data. On 11 March 2015 the interim relief judge of the District Court of The Hague rendered it inoperative, finding that the interference with privacy was not limited to what is strictly necessary (ECLI:NL:RBDHA:2015:2498). That removed the general retention duty for telecom and internet providers, and hosting providers were never its main target. Investigators can still demand data that a provider already holds under Articles 126nc to 126ni of the Code of Criminal Procedure.

What we keep is set out in our privacy policy: your email address, your balance and payment records, your sign-in sessions (browser and country, never the IP address) and your service records. We do not log or inspect the traffic on your server.

The Netherlands is in the Nine and 14 Eyes intelligence-sharing groups, though not in the Five Eyes. Those groups share intercepted communications; data on a server in Amsterdam is still obtained through Dutch and EU procedures, as our guide to what the 14 Eyes mean for hosting explains.

How we handle complaints here

1. Every complaint about a server in Amsterdam is logged and checked against Dutch and EU law.
2. We do not act on a notice because it cites the US DMCA, which has no legal force in the Netherlands. What matters is whether the notice meets the DSA's requirements and concerns content that is illegal under EU or Dutch law. A notice that does is assessed on those terms, whoever sends it.
3. A valid order of a Dutch court, an order from a competent authority under Article 9 of the DSA, a notice that meets Article 16 of the DSA, or a prosecutor's order under Article 125p can require action. You are informed first and can respond, unless a court forbids it or the order itself must stay confidential, as Article 125p orders do. If we restrict content, the DSA requires us to give you a statement of reasons.
4. Requests and outcomes are published in our quarterly transparency report, without customer data.

The EU Terrorist Content Online Regulation also applies here: competent authorities can order terrorist content removed within one hour.

Who it suits

• Latency-sensitive and high-traffic services for Europe: streaming of licensed content, game servers, web applications, downloads and edge nodes.
• Heavy bandwidth and storage. The 10 Gbps unmetered server and the 60 TB storage server are offered only here and in Moldova.
• GPU compute inside the EU, depending on the model.
• Transatlantic and UK reach, with subsea systems to the UK and Atlantic Crossing-1 to New York landing on the Dutch coast.

Available in Amsterdam

Network and latency

Amsterdam is one of Europe's main interconnection hubs and the best-connected of our seven locations. AMS-IX alone connects more than 900 networks. TeleGeography lists nine subsea systems in service on the Dutch North Sea coast, most of them links to the UK, one to Denmark, and Atlantic Crossing-1, which runs to Brookhaven, New York.

In a straight line, Amsterdam is about 360 km from both London and Frankfurt, 430 km from Paris and 5,900 km from New York. For most users in Western and Central Europe, and for transatlantic traffic, it is the first location to test. Our network page lists latency estimates and shows how to measure the real latency yourself.