የኳንተም ኮምፒውቲንግ እና የውሂብ ደህንነት፡ የትኞቹ ህጋዊ ደንቦች ተፈጻሚ ይሆናሉ?

No Dutch or European law regulates quantum computing as such. What applies is the existing law on information security, and it raises one concrete question: will the security measures you take today still be adequate when data encrypted now can be decrypted later? The main exception is export control and investment screening, which do contain specific rules for quantum technology.

Below you will find which obligations already apply, to whom, how you assess which of your data is exposed, and what a defensible migration plan contains.

Three obligations already apply. Article 32 of the General Data Protection Regulation (GDPR, in Dutch AVG) requires security measures that take account of the state of the art. That is a moving standard, not a fixed one, and it also covers data that must remain confidential for years, such as medical records, personnel files and legal archives. The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, requires organisations in the designated essential and important sectors to manage the risks to their networks and information systems, and makes the management body responsible for approving those measures. For financial entities, the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) adds its own requirements on cryptographic controls and third-party risk.

The practical risk is not that someone decrypts your traffic today. It is that encrypted data is intercepted and stored now, to be decrypted once the capability exists. For data with a long confidentiality period, that makes the migration to post-quantum cryptography a present task rather than a future project. International standards for these algorithms have been published and are being adopted.

Quantum technology also brings export control and investment screening into play. Certain quantum items are dual-use goods under European export control rules, and investments in Dutch companies active in quantum technology can be subject to a security screening.

Why does quantum computing raise legal questions about data security?

Because a sufficiently powerful quantum computer could break the encryption on which much of today’s data protection relies. The law does not name quantum computing, but it requires security that matches the risks.

Quantum computing is not simply a faster computer; it is a different way of processing information. An ordinary computer works with sequences of 0s and 1s. A quantum computer uses principles of quantum physics that allow it to solve certain types of problems far more efficiently. That offers opportunities in fields such as medicine, materials research, finance and logistics.

The same power creates a security problem. The public-key encryption that protects much of our digital communication, from online banking to digital signatures, relies on mathematical problems that ordinary computers cannot solve in any practical time. A sufficiently large and stable quantum computer could solve some of those problems. When such a computer will exist is uncertain, but the risk is taken seriously by governments and security services.

What is the core legal challenge?

The challenge is to protect sensitive data against a future threat with the legal tools that exist today. Those tools are open standards such as ‘state of the art’ and ‘appropriate measures’.

The law must encourage innovation in quantum technology and at the same time protect sensitive data against the risks that the technology creates. That is not only a technical problem for cryptographers; it is a question of governance and of legal responsibility.

Any legal approach must deal with a number of concerns:

• Protecting existing data: attackers can collect encrypted data today and store it until they can decrypt it. This is known as ‘harvest now, decrypt later’.
• New standards: organisations must move to post-quantum cryptography (PQC), new encryption methods designed to resist attacks by both ordinary and quantum computers.
• ተጠያቂነት if a data breach occurs because encryption was outdated, the question is who is responsible: the organisation, its supplier or both.
• ፈጠራ- rules must not needlessly hinder research into, and the use of, quantum technology.

How are the Netherlands and the EU approaching this?

The Netherlands and the EU combine investment in quantum technology with coordinated plans for the transition to post-quantum cryptography. Those plans are largely policy, not yet binding law.

The Netherlands and the European Union have taken early steps to include security and legal questions in their quantum strategies. For the security of the Dutch digital infrastructure in general, you can read more about how ኔዘርላንድስ የዲጂታል መሠረተ ልማቷን ደህንነቷን ትጠብቃለች። እና ህጋዊ ጥበቃዎች ቀድሞውኑ በሥራ ላይ ናቸው.

Quantum computing has two sides: it can drive great progress, and it can undermine today’s data security. That is why organisations should not treat this as a future concern, but include it in their security planning now.

Below we discuss the technology, the existing rules, the compliance steps and the legal questions that remain open.

How does quantum computing threaten modern encryption?

Quantum computers can efficiently solve the mathematical problems on which public-key encryption is based. Symmetric encryption, such as AES with long keys, is considered much less vulnerable.

To understand why lawyers and regulators are paying attention, you need a basic idea of the technology. An ordinary computer works with bits that are either 0 or 1. Every digital task, from sending an e-mail to securing a payment, consists of long sequences of such bits.

Quantum computers use quantum bits, or qubits. A qubit can be in a combination of 0 and 1 at the same time, a property called ድግግሞሽ. Together with other quantum effects, this allows a quantum computer to solve certain types of calculations far more efficiently than an ordinary computer.

That advantage does not apply to all tasks. But for some specific mathematical problems it is so great that it directly affects the data security we rely on every day.

Why is public-key cryptography vulnerable?

Public-key cryptography relies on problems such as factoring very large numbers. A quantum computer could solve those problems in a practical time.

Much of our digital security is based on ያልተመጣጠነ ምስጠራ, also called public-key cryptography. It uses two linked keys: a public key to encrypt information or verify a signature, and a private key, known only to the owner, to decrypt or sign.

This system underlies secure websites (HTTPS), VPN connections, e-mail encryption and digital signatures. Its strength lies in the difficulty of certain mathematical problems, such as factoring very large numbers into prime numbers or the discrete logarithm problem. For an ordinary computer, solving these problems for the key sizes in use would take an impractically long time.

A sufficiently powerful quantum computer could solve these problems efficiently. Symmetric encryption, such as AES, is affected to a lesser extent: longer keys, such as AES-256, are generally considered adequate. The legal framework for data security must therefore focus mainly on the public-key systems.

What is Shor’s algorithm?

Shor’s algorithm, published in 1994, is a quantum algorithm that can factor large numbers efficiently. On a large, stable quantum computer it would break the most widely used public-key systems, such as RSA and elliptic-curve cryptography.

The algorithm was developed by mathematician Peter Shor in 1994. It only works on a quantum computer, and the quantum computers that exist today are not yet large and stable enough to break keys in real use.

Shor’s algorithm is in effect a key that fits the locks of today’s public-key encryption. What is missing is the hardware to turn it. Experts disagree about when that hardware will be available, but not about the direction of travel.

Once a large-scale quantum computer is built, data protected with vulnerable public-key methods can be decrypted. That sets a timeline for both legal and technical action.

What is the ‘harvest now, decrypt later’ threat?

Attackers can collect encrypted data today and decrypt it later, once quantum computers are powerful enough. Data that must remain confidential for many years is therefore already at risk.

The danger is not only in the future. In a ‘harvest now, decrypt later’ (HNDL) attack, encrypted data is intercepted and stored now, in the expectation that it can be decrypted once a suitable quantum computer is available. Security services in several countries have warned about this risk.

This mainly threatens information that must remain confidential for a long time, such as:

• State and defence secrets with confidentiality periods of decades.
• የስነአእምሮ ፈጠራ ምዝገባ of companies, such as trade secrets and research data.
• ሚስጥራዊነት ያለው የግል ውሂብ, such as medical and biometric data.
• Financial and legal records ለህጋዊ እና ለቁጥጥር ምክንያቶች ደህንነቱ የተጠበቀ መሆን አለበት.

This threat is a major reason for the policy plans and standards discussed below. For data with a long confidentiality period, the question is not whether, but when, the current encryption must be replaced.

How is the Netherlands preparing for quantum technology?

The Netherlands invests in quantum technology through a national programme and has published practical guidance for the migration to post-quantum cryptography. Specific Dutch legislation on quantum computing does not exist.

The Netherlands treats quantum technology both as an economic opportunity and as a security issue. Organisations therefore have to look at both sides: the opportunities of the technology and the risks for their data.

The national programme ኳንተም ዴልታ ኤን.ኤል brings together government, universities and companies. It builds on the National Agenda for Quantum Technology of 2019 and receives funding from, among others, the National Growth Fund (Nationaal Groeifonds). The programme covers quantum computing, quantum networks and quantum sensing, and pays attention to the social and ethical aspects of the technology. These are policy choices, not rules of ሕግ that bind companies.

Why does cooperation between law and technology matter?

Because rules drafted without technical knowledge quickly become outdated. Cooperation between lawyers, scientists and companies helps to develop standards that keep pace with the technology.

In the Dutch approach, lawyers, scientists and companies work together at an early stage. Lawyers learn what the technology can and cannot do; engineers learn which legal and ethical limits apply. That makes it easier to develop practical standards that keep up with the development of the technology.

This approach helps to avoid rigid rules that either hinder innovation or fail to address new risks. Technology-neutral rules, such as the GDPR’s requirement of security that matches the state of the art, fit this approach: the rule stays the same, but what it requires changes as the technology develops.

Taking security and privacy into account from the design stage onwards, rather than adding them afterwards, is not only good policy. Under Article 25 of the GDPR, data protection by design and by default is a legal obligation for anyone processing personal data.

That also helps to build public trust in the responsible use of quantum technology.

What is being done about post-quantum cryptography?

The Dutch government has published a PQC migration handbook, and organisations are advised to start preparing now. The transition takes years, so waiting increases the risk.

In 2023 the General Intelligence and Security Service (AIVD), research organisation TNO and the Centrum Wiskunde & Informatica (CWI) published a PQC migration handbook. It gives organisations practical steps to prepare for the transition, starting with an inventory of the cryptography they use.

The message is that the move to PQC is not a distant, theoretical problem, but a task that organisations must plan now because it takes years. This fits with the European NIS2 Directive, which requires higher cybersecurity standards for essential and important entities and has been implemented in the Netherlands by the Cybersecurity Act. Organisations that fall under that act must assess their risks, including the risks to their cryptography.

The transition to PQC also protects the digital sovereignty of the Netherlands and Europe. It makes sure that sensitive government and business information remains protected when quantum computers become more powerful.

Which European rules shape quantum data security?

The GDPR, the NIS2 Directive, DORA and the Cyber Resilience Act all require security that matches the risks and the state of the art. Together with the EU roadmap for PQC, they push organisations towards quantum-safe encryption.

National strategies are a start, but the quantum threat is international. Existing data protection and cybersecurity law applies to quantum risks, even though it does not mention them. In addition, the EU is coordinating the transition to post-quantum cryptography. For businesses operating in the EU, it is important to understand how these rules interact.

The underlying principles of current security law remain relevant. The question is how they apply in a world where some of today’s encryption can no longer be trusted in the long term.

How does the GDPR apply in a quantum world?

The GDPR does not mention quantum computing, but it is technology-neutral. The duty to take appropriate security measures that reflect the state of the art also covers the quantum risk.

The GDPR is the basis of EU data protection law. Its principles were written to be technology-neutral, so its requirements also extend to new risks such as quantum computing.

Two provisions are central. Article 25 of the GDPR requires data protection by design and by default: organisations must build technical safeguards for personal data into new processes from the start. Article 32 of the GDPR requires appropriate technical and organisational measures, taking into account the state of the art, the costs and the risks. As post-quantum standards mature, ‘state of the art’ will increasingly mean using quantum-safe encryption for personal data that must remain confidential for a long time. An organisation that does not plan for this transition runs the risk that its security will no longer be considered adequate. Read more about these principles in our guide to the General Data Protection Regulation.

If insufficient security leads to a data breach, the organisation may have to report it to the Dutch Data Protection Authority within 72 hours (Article 33 of the GDPR). The authority can impose fines of up to €20 million or 4% of worldwide annual turnover, and affected persons can claim damages under Article 82 of the GDPR.

Which new EU rules push organisations towards quantum readiness?

The NIS2 Directive, DORA and the Cyber Resilience Act impose broader cybersecurity duties. None of them prescribes specific quantum-safe algorithms, but all require risk-based security that takes account of the state of the art.

Next to the GDPR, several newer EU rules strengthen cybersecurity obligations. They create a path towards quantum-safe standards without naming them explicitly:

• The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847): this regulation sets cybersecurity requirements for products with digital elements, such as connected devices and software. Manufacturers must build security into their products and handle vulnerabilities. The reporting obligations apply from 11 September 2026 and most other obligations from 11 December 2027. The CRA does not prescribe quantum-safe encryption, but it does require security appropriate to the risks.
• የNIS2 መመሪያ፡- this directive extends cybersecurity duties to a wide range of essential and important entities, such as energy, health care and digital infrastructure. It requires risk management, including policies on cryptography and encryption (Article 21), and the reporting of significant incidents. In the Netherlands it is implemented by the Cybersecurity Act.
• DORA: since 17 January 2025, financial entities must have an ICT risk management framework that includes policies on encryption and cryptographic controls, and must manage the risks of their ICT suppliers.

These rules show a clear direction. The move to quantum-safe encryption is not yet an explicit legal requirement, but for organisations with long-term confidential data it follows increasingly from the general duty to take appropriate, state-of-the-art measures.

The obligations of businesses will develop further. The table below shows how the expectations are likely to shift.

How do current and expected compliance standards compare?

The table compares the current approach with what is likely to be expected once post-quantum standards are established. The right-hand column describes expected developments, not current law.

What is considered adequate today may not be adequate in a few years. The standard is forward-looking: data must be protected not only against current threats, but also against future decryption.

The message from EU policy is to plan and start the transition now. Governments and businesses should not wait until quantum computers are operational, but should update their cryptographic systems in a coordinated way to avoid a rush later.

What is the European approach to quantum-safe security?

The EU coordinates the transition to PQC with a Commission Recommendation of 11 April 2024 and a roadmap of June 2025. The roadmap aims to protect high-risk systems by 2030 at the latest.

To prevent a fragmented approach, the EU works on a coordinated transition. On 11 April 2024 the European Commission adopted a Recommendation on a Coordinated Implementation Roadmap for the transition to post-quantum cryptography. On that basis, the Member States, supported by the Commission, published a roadmap on 23 June 2025. It provides that Member States start the transition by the end of 2026, that high-risk systems, such as critical infrastructure, are protected with PQC by the end of 2030 at the latest, and that as many systems as practically feasible follow by 2035.

The roadmap is a political commitment, not a binding law. But it shows what regulators and supervisory authorities will expect, and it is likely to influence how the open standards in the GDPR, NIS2 and DORA are interpreted.

In July 2025 the Commission also adopted a Quantum Europe Strategy, and its work programme for 2026 announces a legislative proposal for a Quantum Act. At the time of writing, such an act is not EU law; check the current status before relying on it.

For businesses this means that compliance is increasingly a European rather than a national matter. The sensible course is to start adapting now.

How do you prepare for quantum-safe compliance?

Start with an inventory of your cryptography, then assess which data and systems are most at risk, and migrate in phases. The aim is crypto-agility: being able to replace algorithms quickly.

Knowing the legal landscape is one thing; turning it into an action plan is another. Becoming quantum-ready is not a single step, but a process of careful, planned phases. The approach below helps your organisation manage the transition and build a legally defensible position.

ግቡ ነው። crypto-አቅም: the ability to replace your cryptographic methods quickly when new threats or standards emerge. The process starts with one question: where are you most vulnerable? Use the requirements of the GDPR and, where applicable, NIS2 and DORA as your framework.

Phase 1: how do you make a cryptographic inventory?

You map all cryptography your organisation uses, including in software and devices from suppliers. Without that overview, you cannot set priorities.

You cannot protect what you do not know you have. The first phase is a thorough inventory of all cryptographic technology in your organisation. It is the basis of your internal policy on quantum risks and helps you show a regulator that you have taken appropriate measures.

Look beyond your main servers. The inventory should cover:

• Data in transit: how are your e-mail, VPN and cloud connections secured?
• በእረፍት ላይ ያለ ውሂብ፦ which encryption protects your databases, backups and laptops?
• የተከተቱ ስርዓቶች cryptography in third-party software, connected devices and network equipment.
• የቆዩ ሥርዓቶች፡- old applications often contain outdated and vulnerable encryption.

A cryptographic inventory works like an X-ray of your organisation. It shows hidden vulnerabilities and dependencies that you must deal with before you can move to a more secure situation.

Also check your contracts. Agreements with IT suppliers and cloud providers should oblige them to provide information about the cryptography they use, to support updates and to cooperate with a migration. Under Article 28 of the GDPR, a processor must also offer sufficient guarantees for appropriate security.

Phase 2: how do you assess risks and set priorities?

Assess your systems by the sensitivity of the data and by how long it must remain confidential. Data that must be protected for more than ten years comes first.

Once the inventory is complete, assess the risks. Not all data is equally sensitive, and not all systems can be upgraded at once. A risk-based approach lets you use your resources where they have the most effect.

Use these questions to set priorities:

1. Which data must remain confidential for more than ten years? Think of intellectual property, long-term financial records and sensitive personal data. This is the main target of ‘harvest now, decrypt later’ attacks.
2. Which systems are most exposed to external threats? Public-facing applications and data transfer protocols are on the front line.
3. What are your legal and contractual duties? The GDPR, sector rules and client agreements determine which security level you must meet for certain data, and for how long you must keep it.

This prioritised list forms the backbone of your transition plan and ensures that the most urgent vulnerabilities are dealt with first.

Phase 3: how do you migrate to post-quantum cryptography?

You replace vulnerable algorithms in phases, starting with the highest risks, and test carefully. Where possible, combine classical and post-quantum methods during the transition.

With clear priorities, you can start the phased migration to የድህረ-ኳንተም ክሪፕቶግራፊ (PQC). This is not a simple replacement. It requires planning, testing and careful implementation, so that business operations are not disrupted. A common approach during the transition is a hybrid solution in which classical and post-quantum methods are used together.

An example: a financial services provider would probably start with the encryption protecting long-term client data, then secure its internal communication networks, and only then update less critical systems with short-lived data. Such a phased approach limits risks and helps to show that the organisation took appropriate measures in time.

Record your choices, the risk assessment and the planning. If a regulator or a court later asks whether your security was adequate, that documentation is your evidence.

Which legal questions remain open?

Besides encryption, quantum technology raises questions about liability, intellectual property, privacy and export control. Some of these can be answered under existing law; others will be for the courts and the legislator.

The steps organisations are taking now are only the start. Quantum technology will affect many areas of law, and several difficult questions go beyond encryption standards.

One of the main questions is liability. If a company suffers a data breach because its encryption was outdated, who is responsible? Under Dutch law, the answer starts with existing rules. Towards the persons whose data was affected, the organisation is responsible under the GDPR and may have to pay damages (Article 82 of the GDPR). Towards clients, it may be liable for failure to perform a contract (Article 6:74 of the Dutch Civil Code). Whether it can recover the damage from a software supplier that did not provide quantum-safe updates depends on the contract and on what could reasonably be expected at the time. Courts will have to work out how ‘state of the art’ develops over time.

Who owns inventions made with quantum computers?

Under current patent law, only a natural person can be named as inventor. An invention developed with the help of a quantum computer can be patented, but the inventor must be a human.

Quantum computers may help to design molecules, materials and algorithms that cannot be designed today. That raises the question of who owns such inventions. The Legal Board of Appeal of the European Patent Office decided in 2021 (case J 8/20) that an inventor named in a patent application must be a natural person, not a machine. Inventions made with computer tools can still be patented, with the human who directed the work as inventor. Contracts should state clearly who owns results created with quantum computing services, especially when you use the computing capacity of a third party.

Quantum computing may also increase the ability to analyse large amounts of data. The GDPR principles of purpose limitation, data minimisation and proportionality apply fully to such analyses, and a data protection impact assessment (Article 35 GDPR) is required where processing is likely to result in a high risk for individuals.

The principle that should guide future rules is crypto-አቅም. It is a technical term, but it also has legal meaning: organisations should design systems and policies so that they can change their cryptography quickly when new threats or standards emerge.

Which export and investment rules apply to quantum technology?

Certain quantum items are dual-use goods under EU export control rules. Investments in Dutch companies active in quantum technology can be subject to a security screening under the Wet Vifo.

Quantum technology is strategically sensitive. The EU Dual-Use Regulation (Regulation (EU) 2021/821) and national measures can require a licence for the export of certain quantum computers, components and related software and technology. The lists change regularly, so check the current version before you export or share technology with parties outside the EU.

In the Netherlands, the Investments, Mergers and Acquisitions Security Screening Act (እርጥብ veiligheidstoets investeringen, fusies en overnames, Wet Vifo) has applied since 1 June 2023. Acquisitions of, and certain investments in, companies active in sensitive technology, which includes quantum technology, must be notified to the Investment Screening Bureau (ቢሮ ቶትሲንግ ኢንቨስተርንገን, BTI) and may not be completed before approval. Start-ups and investors in quantum technology should therefore check at an early stage whether a transaction is subject to notification.

How will global standards develop?

Standards for post-quantum cryptography are already being set internationally. Broader agreements on the use of quantum technology are still at an early stage.

For other world-changing technologies, such as nuclear energy and biotechnology, international rules often started with cooperation between a few countries before broader agreements followed. For quantum technology, cooperation on PQC standards between Europe and the United States is a first step.

Future international agreements are likely to cover:

• የኤክስፖርት መቆጣጠሪያዎች on sensitive quantum hardware and software;
• rules for sharing data in quantum research and development;
• international norms against the use of quantum capabilities for malicious cyberattacks.

The legal framework for quantum computing and data security is not only about defence. It is about making sure that quantum technology can be used safely. Legal planning now helps organisations to benefit from the technology without exposing their data.

በማጠቃለያው

• No law regulates quantum computing as such; the GDPR, the Cybersecurity Act (NIS2) and DORA require security that matches the state of the art and the risks.
• ‘Harvest now, decrypt later’ means that data with a long confidentiality period is already at risk.
• The EU roadmap of June 2025 expects high-risk systems to use post-quantum cryptography by the end of 2030 at the latest; it is a political commitment, not binding law.
• Start with a cryptographic inventory, prioritise by sensitivity and retention period, and migrate in phases with crypto-agility as the goal.
• Quantum technology is also subject to export control and, for investments in Dutch companies, to screening under the Wet Vifo.

ተደጋግሞ የሚነሱ ጥያቄዎች

Quantum computing and data security raise many questions. Below are answers to the questions we hear most often from businesses.

Law & More advises businesses on data protection, cybersecurity obligations and contracts with IT suppliers. Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.

እንዴት Law & More በዚህ ረገድ ሊረዳዎት ይችላል? በእኛ ላይ ተብራርቷል የአይቲ ጠበቃ ገጽ.