Data protection and accessibility for an accounting and tax firm website in Amsterdam: what to require (2026)

The verdict in three sentences

An Amsterdam accounting or tax firm should require from its web provider a GDPR Article 28 processor agreement, a cookie banner where rejecting is as easy as accepting, and intake forms that collect the minimum and never ask for a BSN or tax documents. On accessibility, WCAG 2.1 AA (ideally 2.2 AA), a published accessibility statement and a check before launch belong in the written scope, not in a sales call. For a Dutch and English site, plan EUR 8,200 on the Kolonell Premium tier, against a 2026 ballpark of EUR 10,000 to 25,000 in typical Amsterdam agency quotes.

What should the contract require on data protection?

Under the GDPR (the AVG in Dutch), supervised in the Netherlands by the Autoriteit Persoonsgegevens (AP), your firm is the controller of the data collected through the site. The provider that hosts your forms, backups or analytics is usually a processor, which means the relationship needs a written agreement under Article 28. Accountants and tax advisers also answer to their own professional rules (for chartered accountants, the NBA), so marketing claims and client confidentiality deserve a second read by a partner.

On cookies, the Dutch rules sit in the Telecommunications Act (Telecommunicatiewet) next to the GDPR, and the AP publishes guidance on consent banners. Some analytics set up in a privacy-friendly way may be treated differently, so ask your provider to document exactly which cookies load before and after consent.

The citizen service number (BSN) needs special care: Dutch law only allows it to be processed where a law provides for it. Your firm may need it for filings, but it belongs in your practice software or a secure client portal, never in a website form or a plain email. The same goes for payslips, annual income statements and tax returns. A secure portal or file exchange link is scoped on quote.

What should be required on accessibility?

The European Accessibility Act has applied since 28 June 2025 to a defined list of products and services, such as consumer e-commerce and banking. Microenterprises providing services (fewer than 10 staff and an annual turnover or balance sheet total not above EUR 2 million) are exempt. A brochure site for an accounting firm often falls outside its scope, yet WCAG AA remains the reference in corporate procurement and it serves older clients, visually impaired entrepreneurs and expats who read your pages through translation tools.

Local Amsterdam quotes vs the Kolonell grid

Figures below are a 2026 ballpark drawn from typical agency quotes and public rate pages in the Amsterdam area, not a survey. Market maintenance figures are market assumptions only.

Every Kolonell website project includes a project manager reachable in Central European working hours, native English or French copywriting, delivery in 3 to 4 weeks once content is ready, and 3 months of support. Dutch copy should be written or reviewed by a native Dutch speaker on your side, which is worth stating in the scope from day one.

Mini case study

Illustrative example: Sanne Bakker is a partner in a seven-person tax advisory firm in Amsterdam Oud-Zuid serving expat employees and freelancers. Her current contact form asks for a BSN and accepts file uploads, so about 150 tax documents a year arrive by email. Handling each one by hand takes about 15 minutes: 150 x 15 = 2,250 minutes, or 37.5 hours a year. At an internal cost of EUR 85 per hour, that is about EUR 3,190 a year.

She scopes a Dutch and English site on Premium (EUR 8,200), plans an independent accessibility audit (assumed EUR 3,000) and asks for a portal link on quote. The visible cost of EUR 11,200 is covered by the time saved in roughly 3.5 years (11,200 / 3,190). The stronger reason is risk: no BSN and no tax files left in mailboxes.

FAQ

Can our website contact form ask for a BSN?

It should not: Dutch law restricts BSN processing to cases provided for by law, and a marketing form is not one of them. Keep first contact to 4 or 5 fields and collect identifiers later inside your secure portal.

Do we need a cookie banner if we only use analytics?

Possibly not for narrowly configured, privacy-friendly analytics, but the conditions are strict and must be documented. The safe default is zero non-essential cookies before consent, with reject and accept on the same first layer.

Does the European Accessibility Act apply to our site?

Often not for a brochure site, and service microenterprises under 10 staff and EUR 2 million are exempt. Targeting WCAG 2.2 AA still costs little at build time compared with a EUR 2,000 to 6,000 retrofit audit.

Who notifies the AP after a data breach?

Your firm, as controller, within 72 hours of becoming aware of a notifiable breach. Write a provider alert delay, for example 24 hours, into the Article 28 agreement.

How long does a compliant build take?

3 to 4 weeks at Kolonell once texts and the privacy notice are ready. Add 1 to 2 weeks if you commission an independent audit before launch. This is not legal advice.

Let's scope your project. A Dutch and English firm site with clean forms, consent and a WCAG AA target, from EUR 4,500 single-language or EUR 8,200 bilingual, delivered in 3 to 4 weeks. See the international offer or request a free quote: detailed reply within 48 hours.