Data Act, NIS2 and Other EU Rules

Last updated: 12 November 2026

Scope of this page

This page covers the EU and Dutch rules, other than the GDPR, the AI Act and the Digital Services Act, that matter most to customers of SSStudio, trading as LeraLink ("we"). Those three have their own pages: GDPR at LeraLink, EU AI Act at LeraLink and Digital Services Act at LeraLink.

For each rule we say whether and how it applies, and what we do. Where applicability depends on facts or interpretation that are not settled, we say so.

Data Act: switching and exit (chapter VI)

Does it apply?

Regulation (EU) 2023/2854, the Data Act, has applied since 12 September 2025. Chapter VI sets rules for switching between data processing services. LeraLink is a software service delivered over the network and is, in our assessment, a data processing service within the meaning of the Data Act. We therefore apply chapter VI.

Chapter VI does not apply to non-production versions offered for testing and evaluation for a limited period (art. 31(2)). LeraLink is in a controlled pilot, but pilot installations are used for real work, so we do not rely on that exception.

What the Data Act requires, and how LeraLink's exit terms align

What an export contains

An installation export is a single archive in open formats: structured data in JSON, works in Markdown and HTML, people in CSV, and the original files as they were uploaded, up to 2 GB of files per archive; files beyond that are named in the manifest, and we help with a larger export on request. A manifest lists the contents, with a checksum, so that the archive can be checked and rebuilt without LeraLink. Sign-in credentials and provider secrets are left out on purpose.

Individuals can separately download their own data from their account, as described in Your Data Rights.

Pending changes

The European Commission has proposed amendments to the Data Act as part of its digital omnibus package, including targeted exemptions from some switching rules for smaller providers. They had not been adopted when this page was written. We will review our terms if they are, but we do not plan to reduce the exit commitments above.

NIS2 and the Dutch Cyberbeveiligingswet

The law

Directive (EU) 2022/2555 (NIS2) is implemented in the Netherlands by the Cyberbeveiligingswet (Cbw), in force since 15 August 2026. It places a duty of care, incident reporting obligations and registration duties on essential and important entities in listed sectors.

Is SSStudio in scope?

Probably not, as things stand. NIS2 applies, in general, to entities of at least medium size: 50 or more staff, or an annual turnover and balance sheet above the thresholds of Commission Recommendation 2003/361/EC (art. 2(1) NIS2). SSStudio is a micro enterprise. The exceptions that apply regardless of size, such as for DNS service providers, top-level domain registries, trust service providers and providers of public electronic communications, do not describe LeraLink's service. A national authority can also designate a smaller entity in specific cases; SSStudio has not been designated.

We will reassess this if SSStudio grows, changes legal form, or if the authorities give guidance that affects software services of this kind.

Supporting customers that are in scope

Customers may themselves be essential or important entities. Under the Cbw, Dutch government organisations must apply the security measures of the Baseline Informatiebeveiliging Overheid (BIO2). Essential and important entities must manage the security of their supply chain (art. 21(2)(d) NIS2) and report significant incidents within short deadlines (art. 23 NIS2). We support them as a supplier:

Accessibility: European Accessibility Act and WCAG

European Accessibility Act

Directive (EU) 2019/882, the European Accessibility Act, has applied since 28 June 2025 to specific products and services offered to consumers, such as e-commerce, consumer banking, electronic communications and e-books. LeraLink is mainly offered to organisations. Where a part of it falls within the Act, microenterprises providing services are exempt from its accessibility requirements (art. 4(5)), and SSStudio is a microenterprise. A customer that offers an in-scope service to consumers through its installation should check its own obligations.

Public-sector websites

Public-sector bodies must make their websites accessible under Directive (EU) 2016/2102 and the Dutch rules that implement it, which require the standard EN 301 549 (and through it WCAG 2.1 level AA) and an accessibility statement. That duty is the public body's own, also for an installation it runs on LeraLink.

What we do

We aim for WCAG 2.2 level AA across the platform anyway, which includes the level AA criteria of WCAG 2.1. No independent audit or full conformance assessment has been carried out yet, so we do not claim full or partial conformance. The Accessibility Statement describes the status and how to report a problem (accessibility@lera.link). A public-sector customer that needs an assessment for its own accessibility statement should plan for one.

Cookies and browser storage: ePrivacy and the Dutch Telecommunications Act

Directive 2002/58/EC (the ePrivacy Directive) is implemented in the Netherlands in art. 11.7a of the Telecommunicatiewet. Storing or reading information on a user's device requires consent, unless it is strictly necessary for a service the user asked for.

LeraLink sets only sign-in session cookies, which are strictly necessary, and two language cookies, set when a person chooses a language. Other items in browser storage serve only a function the person is using. It uses no analytics or advertising cookies. Content from other services, such as embedded video, loads only after the reader allows it. The Cookie and Local Storage Statement lists each cookie and each kind of browser storage.

An installation that adds its own measurement or embedded services must describe them in its own notice and obtain consent where required.

International transfers: EU–US Data Privacy Framework

Where personal data reaches a recipient outside the European Economic Area, chapter V of the GDPR applies. For recipients in the United States, we rely on the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified, and otherwise on the Standard Contractual Clauses.

The EU General Court dismissed a challenge to the Data Privacy Framework on 3 September 2025. An appeal is pending before the Court of Justice (Case C-703/25 P). If the Framework were annulled, we would rely on the Standard Contractual Clauses with supplementary measures, and assess whether any processing should move. Where Your Data Is Stored and Subprocessors and Recipients describe which data leaves the EU.

Dutch information duties

As a business established in the Netherlands, we give the information required by the Dutch Civil Code for information society services (art. 3:15d BW, implementing art. 5 of Directive 2000/31/EC): our name, geographic address, email address, Chamber of Commerce number and VAT number: SSStudio, The Hague, the Netherlands; Chamber of Commerce (KvK) 98779885; VAT identification number NL005352396B67. Postal address on request: legal@lera.link. The other details are on Company Information. Where a customer is a consumer, the Dutch rules on information before a distance contract (art. 6:230m BW) also apply.

What we monitor

Changes that affect customers are announced under the Change Notification Policy.

Contact

Legal and regulatory questions: legal@lera.link. Privacy: privacy@lera.link. Security: security@lera.link. Accessibility: accessibility@lera.link.

Sources