What are the consequences of non-compliant data storage?

Non-compliant data storage poses a growing risk to Dutch organizations at a time when digital technology is increasingly central to business operations. With the increasing focus on data sovereignty and stricter European legislation, the consequences of improper data storage can be far-reaching.

From financial penalties to reputational damage and operational disruptions, the impact of non-compliant data storage affects all aspects of your organization. Understanding these risks is essential to making informed decisions about your data infrastructure.

What exactly does noncompliant data storage mean?

Non-compliant data storage means that your organization stores or processes data in a way that does not comply with applicable laws and regulations, such as the AVG, or with specific contractual obligations. This includes both technical and legal aspects of data processing.

The main forms of non-compliant data storage are storing personal data outside the EU without adequate safeguards, lack of proper security controls and encryption, and non-compliance with data retention periods. It also includes sharing data with third parties without the proper legal basis.

Since the invalidation of the EU-US Privacy Shield in 2020, thousands of companies have been forced to adjust their data transfers. This underscores the importance of data sovereignty: the ability to maintain control over digital assets and infrastructure within your own jurisdiction.

A practical example is using cloud services from large U.S. providers without adequate contractual safeguards. While technically possible, it can be legally problematic when foreign authorities can demand access to your data.

What financial penalties do you risk for non-compliant data storage?

For non-compliant data storage, your organization risks AVG fines of up to 4% of global annual revenue or €20 million, whichever is higher. These fines are calculated based on the severity of the breach and the size of your organization.

The amount of fines depends on several factors. Supervisors look at the nature and severity of the violation, the number of people affected, the duration of the violation and whether there was intent or negligence. Your cooperation during the investigation and any previous violations also play a role.

In addition to AVG fines, sector-specific sanctions may follow. Healthcare institutions may face fines under the Medical Treatment Agreement Act, while financial institutions risk sanctions from De Nederlandsche Bank.

More important still are often the indirect costs: legal representation, forensics, system recovery and compensation to affected customers. These costs can far exceed direct fines and continue for months.

How does non-compliant data storage affect your corporate reputation?

Non-compliant data storage can seriously damage your corporate reputation through loss of customer trust, negative media coverage and long-term reputational damage. Customers lose trust in organizations that do not adequately protect their privacy.

Reputational damage manifests itself in a variety of ways. Customers may switch to competitors, potential new customers may stay away, and existing partnerships may be terminated. In B2B markets, confidence in your data security is often crucial for contract renewal.

Media coverage of data breaches or privacy violations can last for months. Social media amplifies this effect, with negative experiences spreading quickly. For organizations in trust-sensitive sectors such as healthcare, education or financial services, this can be particularly damaging.

Recovery from reputational damage takes time and significant investment in communications and enhanced security measures. Research shows that organizations take an average of two to three years to fully recover from a major data breach.

What operational risks does noncompliant data storage pose?

Non-compliant data storage poses operational risks such as forced system migrations, business process interruption, loss of access to critical data and increased vulnerability to cyberattacks. These disruptions can cripple your business operations for days.

An acute risk is having to suddenly migrate systems when regulators demand a shutdown. This can lead to data loss, system downtime and high migration costs. Employees must quickly learn new systems, which temporarily reduces productivity.

Non-compliant storage also increases vulnerability to cyberattacks. Inadequately secured systems are attractive targets for criminals. A successful attack can lead to ransomware, identity theft or industrial espionage.

Supplier dependence represents another operational risk. When you are dependent on non-compliant systems, it can be difficult to transition quickly. This can make your organization vulnerable to sudden policy changes or acquisitions by foreign parties.

How Pegamento helps with compliant data storage

We help organizations with compliant data storage by providing ISO 27001-certified solutions that comply with Dutch laws and regulations. In partnership with Uniserver, part of the Open Cloud Alliance, we offer sovereign cloud solutions that keep data within Dutch borders.

Our approach includes:

  • Full control over data location and processing within the Netherlands
  • Advanced security controls with data classification
  • Compliance support for the AVG and industry-specific regulations
  • Data portability to avoid vendor dependency
  • Integrated backup and disaster recovery solutions.

Through our AI-driven intelligence and a smart combination of proven standard building blocks, we deliver customized solutions without costly customization. You get everything under one roof: from development to management and support.

Want to know how to make data storage compliant while improving your operational efficiency? Contact us for a personal consultation on your specific situation.

Frequently Asked Questions

How do I know if my current cloud solution is AVG compliant?

First, check where your data is stored and processed - is this clear in your contract? Ask your cloud provider for a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs). Pay particular attention to whether U.S. providers have access to your data and whether adequate technical and organizational measures are in place. If in doubt, it's best to have a privacy expert review this.

What are the first steps to switch to compliant data storage?

Start with a data audit to inventory what data you store and process where. Then create a migration plan with priorities - critical personal data first. Ensure a smooth transition by running parallel systems during the migration and train your employees on the new environment in a timely manner. Plan at least 3-6 months for a full migration.

Can we continue to use our existing Microsoft 365 or Google Workspace?

This depends on your configuration and contractual agreements. Both providers offer EU data center options, but you need to explicitly verify that data actually stays within Europe and whether U.S. authorities can demand access. Often a hybrid approach is possible where sensitive data is stored locally and less critical workloads remain in the cloud.

What happens if the Personal Data Authority starts an investigation into our data storage?

The AP can start a formal investigation, request documents and do on-site inspection. You are required to cooperate and provide all requested information. During the investigation, temporary measures may be imposed, such as stopping certain data processing operations. It is crucial to engage legal counsel immediately and carefully document all communications.

On average, how long does it take to perform a data migration to compliant storage?

A full migration usually takes 3-12 months, depending on the complexity of your IT landscape and amount of data. Critical systems can often be migrated within 6-8 weeks, while legacy systems require more time. Schedule extra time for testing, training, and running old and new systems in parallel to minimize downtime.

What cost should I charge for compliant data storage compared to regular cloud services?

Compliant data storage typically costs 20-40% more than standard cloud services, but saves significant costs on compliance, legal risks, and potential penalties. The additional cost is often offset by improved security, local support and reduced vendor dependency. Also calculate the hidden costs of non-compliant storage: fines, reputational damage and operational disruptions can be many times more expensive.

More blogs

Download the white paper here

Deepen your knowledge with Pegamento’s white papers.

Joost Schaap-Account manager Pegamento

Joost Schaap

Senoir Account Manager

When a customer contacts an organization because they have a complaint, it is crucial that the employee of the organization begin by listening carefully. What does this complaint mean for the customer and also for their own organization? How can this complaint be resolved? After listening carefully the employee needs the right information so that a solution can be offered.

This piece was written by Joost Schaap, working as an Account Manager at Pegamento.

Tim Treurniet-AI developer Pegamento

Tim Treurniet

Designer of Intelligent Systems

Real childhood heroes I never had. But in retrospect, I believe figures like Willie Carrot or Dexter’s lab may have had an influence on me. I get energy from actually making innovative and useful products myself. Nothing like seeing the effect of a project that automates a boring task, or makes a complex process suddenly accessible.

A nice bridge to my photograph is the physical aspect of my work. By working with image recognition, I am often very directly connected to the physical world and my work is more than just programming. For example, our image recognition software ensures safety on bridges, tracks players on a soccer field or uses your own smartphone to accurately measure yourself. This combination between physical and digital provides variety and extra challenge. For me, these are the main reasons for my interest and enthusiasm in what I do!

This piece was written by Tim Treurniet, employed Designer of intelligent systems at Pegamento.

Vera van der Plas-UI-UX designer

Vera van der Plas

UI/UX Designer

As a UX/UI designer, I deal daily with transforming complex data into user-friendly visualizations. All of this topped off with a digital lick of paint which should attract the visitor’s attention to take action.

One of the interesting aspects of this field I find the effects that small tweaks, both textual and visual, can have on conversion. The psychological impact that a simple background color of a CTA button has on our behavior is huge. After all, that color can determine whether or not you are going to buy that product.

What we see and how our brains process and interpret this information fascinates me. The possibilities of subconsciously pointing potential customers in your chosen direction are endless. I hope to apply my expertise more often within our solutions in the future.

This piece was written by Vera van der Plas, working as a UX/UI Designer at Pegamento.

Fouad Rahaoui-Finance Pegamento

Fouad Rahaoui

Financial Controller

A Financial Controller within a company should not only be an expert in Finance. You must also have knowledge of the latest IT developments. Because these are also moving very quickly in the world of Finance.

At Pegamento, I can learn all about the latest IT developments. Like the latest development in the field of Machine learning and deep learning.

Through these application areas, as Financial Controller, I can further automate the financial business processes within Pegamento and implement improvements for the automatic processing of financial data.

This piece was written by Fouad Rahaoui, working as a Financial Controller at Pegamento.

Ernst Vegter-Business consultant Pegamento

Ernst Vegter

Business Consultant

Hospitality is one of my deepest motivations.
Not surprisingly, of course, customer service is a common thread in my career. Aspects of hospitality is being able to connect, to facilitate but mainly to make someone feel genuinely welcome. My intuition is my greatest asset to be able to put myself in the shoes of a guest. A customer is my guest.

Fed by various senses, an image forms around the client. I listen to what is being said, watch facial expressions, taste the underlying tone and get a feel for the challenge to be addressed. An image literally forms on my retina. I have to be able to see it. If I can see it, I can create it.

In this, the trick is to pursue simplicity, give the client a warm feeling that the problem is understood, receive good advice, facilitated and carefully guided to the solution. Trust, connect and unburden.

The feeling when a guest arrives at your hotel after a long tiring journey, can sit in front of the fireplace, be handed a good glass of wine and stare carefree at the fire. My guest knows it will be okay.

This piece was written by Ernst Vegter, working as a Business Consultant at Pegamento.

Gunisch-AI developer Pegamento

Gunish Alag

AI Developer

A picture is worth a thousand words, is an expression most of us have heard. We see a lot of things around us on a daily basis and subconciously have the ability to recognize and understand them. This ability of humans to me seems bizarre.

As a computer vision developer at Pegamento that is what I do, break down complex problems and turn them into solutions using images by meticulously extracting useful data.
With the world moving forward and new technologies emerging, complicated problems which were difficult to solve a decade earlier suddenly seem possible and viable. The future is full of new challenges and I look forward to them.

This story is written by Gunish, working as an AI developer at Pegamento.

Ewold Jansen-Service engineer Pegamento

Ewold Jansen

Service & Support Engineer

Hearing the wishes a customer has or the problems a customer is facing is important in order to then be able to help them properly. In both cases, I help find the right solution.

When the customer comes to us with a desire, they don’t know what all the options are. In this I advise them to make the right choices. When problems arise, listening to them is important. For example, a problem arises from a wrong action. By communicating well in this, many problems can be solved quickly by explaining it well. Through poor communication, a small problem can become very big.

This piece was written by Ewold Jansen, working as a Service & Support Engineer at Pegamento.

Andre Glasbergen-Scrum master Pegamento

Andre Glasbergen

Scrum Master

After completing my studies, I started working as a developer at a young Pegamento with a lot of ambition and enthusiasm. In the first years I learned all about process automation, now better known as RPA. I often had to rack my brains to convert the work instruction into a logical function, with not too many If-statements, so that the robot could perform the work.

I developed further and went to work as a consultant. Listening well to the customer and supporting in the pre-sales phase of projects. Executing projects and listening suited me very well. It was a small, but logical, step to now work as a Scrum Master and Project Manager. I have been supervising projects for a few years now. Such as RPA, Cloud applications and AI, according to the Human lead agile approach, We build this with a large team of specialists.

This piece was written by André Glasbergen, working as a Scrum Master at Pegamento.

Ensar Ari-IT engineer Pegamento

Ensar Ari

IT Engineer

Good communication between customer and organization is very important. As an organization, you naturally want to be easily accessible to your customers. Either via social media channels or via the old familiar telephone. Often organizations do not know exactly how they want their telephone line set up. That is why I like to help them think along and give them ideas. I believe there is a solution to every problem. But sometimes you just need someone who looks at the situation a little differently.

This piece was written by Ensar Ari, working as an IT Engineer at Pegamento.

Nini Heerings-Chief Happiness Officer Pegamento

Nini Heerings

Chief Happiness Officer

“You get to know someone better by playing for an hour than by talking for a year.”

This quote from Plato is totally hitting home for me. That’s why I like to connect people through play. Because while playing, you are totally on, all your senses at work.
In my great role as Chief Happiness Officer, I want to do that by connecting colleagues with each other and with the organization. In a creative and playful way that suits Pegamento.

When I’m not at work, I also enjoy connecting people. I do this by organizing The Playground, where adults play games you used to play in the schoolyard, gymnasium or neighborhood playground. The pure feeling of fun, total relaxation and no thoughts of anything but playing. That feeling is the goal.

This piece was written by Nini, working as Chief Happiness Officer at Pegamento.

Ger Koedam-Communication & Marketing Pegamento

Ger Koedam

Marketing & Communications

How can I help you? That’s pretty much the first question I ask when talking to people who are curious about our services. In such a conversation, the use of senses is very important. Because not everyone is the same. One person thinks in images, while for another words are important or how something feels. For me, sight and hearing are the most beautiful senses, because both eyes and ears absorb information and can convey or process emotions.

Why hearing? Because listening is essential in contact. And it’s the key to unlocking valuable insights.

I developed this skill early on. As a child, I enjoyed radio plays on the radio, bringing the stories to life in my head.

Pim Ritmijer-Software developer Pegamento

Pim Ritmeijer

Software Developer

Programming is more than just “code knocking. For me, listening to what the customer wants and visualizing that is an important part of software development.

Actively listening to a customer to understand the customer’s full story is crucial before building a solution. When you understand a customer’s story, you can think together about a solution that truly helps the customer.

Visualizing solutions is the next step for me. What will be the route we will climb to get to a solution? What challenges are we going to face to get to the top?

Like climbing, good preparation is valuable. Even though you can’t prepare for everything, preparation helps make the application fit the client’s needs as well as possible.

What a beautiful and fascinating profession programming is.

This piece was written by Pim Ritmeijer, working as a Software Developer at Pegamento.

Denise Verhoef-Software developer Pegamento

Denise Verhoef

Software Developer

Hearing is something you do a lot of as a programmer but also thinking, for example, when you are tasked with putting together a customer need. If the customer wants a function for his application, it is important that as a programmer you think carefully about which functions are functional and which functions are not. In this way, you will put together the most functional application possible and the customer will have a good end product. Turning needs into code into functionality is something I find interesting.

I am currently doing an internship at Pegamento and studying Software Developer. I get a lot of information that you have to process and apply. The nice thing about this is that you can learn new things but also that you can experience how it works in real business. I started this training last year and knew nothing about programming beforehand. Now I can find my own way with programming and I enjoy working with it. That you can get from a blank page to a functional application through code is cool!

This piece was written by Denise Verhoef, working as a Software Developer intern at Pegamento.

Remco Pabst-Business consultant Pegamento

Remco Pabst

Computer Vision & AI Lead

Using innovative software technology for people or business to make “things” easier and smarter is really a driving force. That’s why the connection between the senses appeals to me the most. Our brains connect the senses just like a business process connects people, systems (data) and logic. They register and trigger an action, exactly how it should be in an optimal workflow. Very cool what is already possible today when we add a lot of computational power to that as well.

Hearing also means a lot. Not because I like to listen to Jazz, Soul, Deep House or Focus-like music every day AND have to be able to listen well to interpret a wish or pain point, but more because not everyone can have all the senses at their disposal. Think of him or her with a visual impairment. The fact that in close cooperation we were able to apply AI, TTS/STT technology (which is still in development) for this often underserved group of people in today’s digital world and to improve the interaction and experience with it gives me a lot of energy and meaning to what I try to do with technology; create value.

This piece was written by Remco, working as a Business Consultant at Pegamento.

Thomas de Wolf-Vision Engineer Pegamento

Thomas de Wolf

R&D Director

Once when I had to choose which study I was going to do, I had a hard time making that choice. I was interested in engineering, but what I most wanted to do was just work with a team toward a common goal.

To this day, that is still what I love doing most. The technology has become image recognition and the team the computer vision department of Pegamento. So it’s logical that in terms of sense, I end up with “seeing. By using our image recognition solutions to see things in the real world, our entire team solves relevant problems for our customers. And because of the variation in customers, the places where our solutions end up are never the same. For example, one moment I am in the control room of a bridge and the next day I am on a production line for sandwiches or between the fences of a TBS clinic.

This piece was written by Thomas de Wolf, working as a Computer Vision & AI Lead at Pegamento.

Rob Roode-Research Development

Rob Roode

Research & Development

Recognizing and automating patterns. Tasks we are constantly working on when implementing our robots at Pegamento. My 2 Drentsche Patrijshonden are hunting dogs and certainly not robots. The hunting instinct and intuition is basically in their genes. Continuing to offer new forms of training has taught them to recognize and act independently in hunting situations. Even “unsupervised,” even if I’m not around.

But when you try to teach a brain something, it also starts to see things you don’t expect. Dogs pick up on the slightest deviation in your voice or directions. To start recognizing that and correcting it again is perhaps the most complex challenge. But in our work, for the wonderful clients for whom we get to work, it often yields the most beautiful new insights!

This piece was written by Rob, founder of Pegamento and in charge of Marketing and R&D.

Serge Poppes-CEO Pegamento

Serge Poppes

CEO

Feeling. That’s the best thing Pegamento stands for. Feeling for technology in the broadest sense of the word. Not only feeling for the exciting stuff like AI, but also for the basics of communication.

The very best part of my job is selling, listening, translating and thinking about what really matters. We bring the digital transformation with a great team!
The diversity of our team, how sharp we are, but especially the wonderful things we get to make makes me feel extremely good. Hence, I intuitively chose the sense of “feeling.

Feeling gives life and differentiation!