IT for Notarial Practices: KNB Code of Conduct, Wwft and a Secure Workplace

As a civil-law notary, you handle some of the most sensitive paperwork there is: notarial deeds, wills, prenuptial agreements, mortgage files, UBO checks and client funds held in escrow. A single leaked deed or one cyber incident immediately means a disciplinary complaint and trouble with the BFT (the Dutch Financial Supervision Office) and the KNB (the Royal Dutch Association of Civil-law Notaries). In this article you'll learn how to set up the IT of a notarial practice so you can demonstrably comply with the KNB Code of Conduct on Information Security as well as the Wwft (the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act), the Sanctions Act and the GDPR.

Why IT for notaries is a discipline of its own

Legally speaking, a notarial practice is not an ordinary business. You are a public officer, a gatekeeper under the Wwft and the custodian of authentic deeds that have to be kept for decades. You work with special categories of personal data and with client funds held in a separate client escrow account. That makes you an attractive target for phishing, invoice fraud and ransomware, and it makes the consequences of an incident more serious than for an average SME.

On top of that, supervision has become stricter. Since 1 February 2025, the KNB Code of Conduct on Information Security for Notaries has been mandatory for every member practice. The code translates the open standards in the GDPR and the Dutch Notaries Act into concrete requirements. "We do our best" is no longer good enough: you need to be able to show, on file, that your measures are in order and that you maintain them.

What the KNB Code of Conduct on Information Security actually requires

The code of conduct contains around 95 minimum requirements, split across technical measures, policy, suppliers, awareness and physical security. The requirements themselves aren't particularly exotic if your IT is already well managed, but taken together they are substantial. A selection of what is expected of you in practice:

• Policy and accountability. You document who has ultimate responsibility for information security (in practice often one of the notary partners) and who fulfils the operational role.
• Access management. At least once a year, check which employees and former employees still have access rights to systems, files and buildings. Revoke any rights that are no longer needed.
• Awareness. All staff, including the notary, receive verifiable annual training on phishing, password hygiene and recognising social engineering.
• Backup and recovery. Make daily and weekly backups using different methods, keep them for at least 30 days and run a restore test at least twice a year.
• Incident logging and drills. You log and evaluate security incidents and use them to refine your policy. You rehearse emergency scenarios periodically.
• Supplier management. You assess all relevant IT suppliers (workplace management, hosting, backup, and software vendors such as your notarial software provider) against the code's requirements every year.
• Notification. In addition to the GDPR notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, a serious incident or large-scale data breach must also be reported to the KNB.

A good IT partner for notaries delivers more than technical management: they also build the documentation you need to demonstrate compliance with these requirements. That is exactly why outsourcing IT security for a notarial practice is a different conversation from outsourcing it for a trading company.

Building the Wwft gatekeeper role into your IT

Alongside the code of conduct, the Wwft and the Sanctions Act also affect your IT processes. For every client and every transaction, you carry out customer due diligence: identity, the nature and background of the transaction, the source of funds, UBOs (ultimate beneficial owners) and PEP (politically exposed person) status. Anyone with an interest of more than 25 percent in a legal entity counts as a UBO. You report unusual transactions to FIU-the Netherlands, and sanctions hits must be reported too.

In addition, since May 2019 you are not allowed to accept or pay out cash amounts above €2,500. That is a professional rule, not a suggestion.

For your IT, this means in concrete terms:

• Your notarial software must keep an audit trail per file: who carried out the due diligence, which sources were consulted and when the sanctions list was checked.
• Sanctions lists (EU, UN, OFAC) must be kept up to date. Doing this manually no longer works; integrations or compliance tooling are more realistic.
• You keep Wwft due diligence records and reports for five years after the end of the business relationship or transaction. Deeds are subject to a much longer retention obligation.
• Access to Wwft files is restricted to people who need it for their work.

The BFT supervises compliance. If your record-keeping isn't in order, that will surface immediately during a BFT investigation.

The GDPR alongside the KNB code and the Wwft

Notarial practices are data controllers for special categories of personal data. The GDPR imposes obligations that partly overlap with the KNB code but are stricter in some areas.

• Data breach notification within 72 hours. Even when in doubt, the rule is: report first, evaluate afterwards. For serious incidents you also file a separate report with the KNB.
• Data processing agreements. Every IT supplier that processes personal data (from your workplace management provider to your backup provider) needs a data processing agreement.
• Retention and destruction. You may not keep personal data indefinitely once you no longer need it for the purpose it was collected for. For the content of deeds that period is long; for quotes to clients who didn't proceed, it is short.

In practice, complying with the GDPR comes down to a record of processing activities, clear retention periods per process and periodic reviews. In a notarial practice, you take that further than a typical SME would.

A secure digital workplace for notaries

A modern notarial workplace is almost always built on Microsoft 365, combined with notarial software. What makes such a workplace KNB-proof?

• MFA on everything. No workstation without multi-factor authentication. See implementing MFA in your business.
• Roles and permissions. A junior member of staff does not automatically get access to every will or prenuptial agreement.
• Endpoint security. Every device is managed (MDM, encryption, patching). A missing laptop is then a licensing issue, not a data breach.
• Secure communication. Email alone is no longer enough for sensitive documents. Secure client portals are the standard.
• Separating the office from the case file. Documents live in a controlled environment, not as loose attachments in the email archive.

For more background, see our overview of setting up a modern workplace for SMEs.

Digital signatures: what is and isn't allowed

Digital signatures are governed by the eIDAS Regulation, which has three levels: simple, advanced and qualified. The first two often work for corporate legal documents; they don't work for documents that replace an authentic deed.

The notarial deed itself still requires a physical execution: the parties present together before the notary. Around that core act, however, much can be done digitally: client intake, preparing powers of attorney, exchanging mortgage documents and signing non-notarial supporting documents. Use digital signatures where they are permitted and save time, but above all, get the surrounding workflow in order.

Backup, ransomware and client funds

Backup is explicitly included in the KNB code for good reason. Ransomware in the notarial sector is not hypothetical. Attackers know that a notarial practice has to be able to deliver quickly for scheduled deed executions.

At a minimum, set up:

• Daily backups of your notarial software, email and documents.
• Weekly backups stored using a different method from the daily ones.
• A minimum of 30 days' retention for the most recent backups.
• An immutable or offline copy that an attacker with administrator rights cannot encrypt.
• A real restore test twice a year: actually restoring a file and opening it.

There is more on the architecture of modern backup in the complete backup strategy for SMEs. As for client funds: the escrow account itself is held at the bank, but the files that account for the balances are held by you. Lose those, and the BFT will be at your door sooner than your insurer pays out.

What does KNB-compliant IT cost?

Prices vary widely between providers. In the Dutch market in 2026, these are typical ranges:

• Outsourced management of a Microsoft 365 workplace: €10 to €25 per user per month, excluding licences.
• A fully managed digital workplace (all-in, with basic support, security tooling and backup): €40 to €90 per user per month.
• Separate Microsoft 365 backup: a few euros per mailbox per month.

Be wary of providers promising "a complete KNB-compliant package" without building your documentation themselves. The KNB itself has warned about aggressive sales tactics around the code of conduct. It is your practice that must demonstrably comply, not your supplier. For more guidance, see what outsourcing IT costs for SMEs.

NIS2, the Cybersecurity Act and the notarial sector

A confusing point in 2026: does NIS2 apply to notarial practices? The short answer is no. The KNB deliberately set up the code of conduct as a sector-specific alternative, and the notarial sector has not been designated as a sector under the Dutch Cybersecurity Act (Cyberbeveiligingswet). That doesn't make NIS2 irrelevant: many of your clients and suppliers do fall under it. What they ask of you as a link in their supply chain may turn out to be stricter than the code of conduct itself.

See also our complete guide to NIS2 for SMEs if, for example, you work for estate agents, insurers or financial service providers that are subject to NIS2.

A pragmatic action plan

If your baseline assessment is still showing red, this is a workable order:

1. Baseline assessment. Go through the KNB requirements with your IT partner and record for each one: compliant, partially compliant or non-compliant. Every non-compliant item becomes an action point.
2. Quick wins. MFA on everything, up-to-date patching, a password manager and hardening of highly privileged accounts. See the cybersecurity checklist for SMEs.
3. Backup and recovery. Retention, an immutable copy and a restore drill. Without these, everything else is cosmetic.
4. Policy and documentation. Document your information security policy, bring your record of processing activities up to date and check your data processing agreements.
5. Supplier audit and awareness. Annual assessment, annual training and an incident register.
6. Maintenance. The code of conduct isn't a project; it's an annual cycle.

Frequently asked questions about IT for notarial practices

From what date must my notarial practice comply with the KNB Code of Conduct on Information Security? Since 1 February 2025, all notarial practices that are members of the KNB must fully comply with the code of conduct. The code was published in three stages. Compliance means more than having your technical house in order; you must also be able to demonstrate that your policy, annual cycle and documentation are in order.

Is NIS2 mandatory for notarial practices? No. The notarial sector has not been designated as a sector under the Dutch Cybersecurity Act, which implements NIS2. The KNB set up the Code of Conduct on Information Security as a sector-specific alternative. However, clients and suppliers that fall under NIS2 themselves may impose additional requirements on you as a link in their supply chain.

What is the difference between reporting a data breach to the AP and to the KNB? The 72-hour notification to the Dutch Data Protection Authority (AP) under the GDPR still applies to every data breach that poses a risk to the people involved. In addition, the KNB code of conduct introduces its own reporting obligation for serious security incidents and large-scale data breaches. In most cases this means two reports for the same incident, each with a different purpose.

Can I, as a notary, sign digitally on behalf of clients? Not for the notarial deed itself: that requires a physical execution at which the parties (or their authorised representatives) are present at the same time. For the surrounding workflow (quotes, preparing powers of attorney, exchanges with the mortgage lender, signing non-notarial supporting documents), digital signatures based on eIDAS are possible. Whether a simple, advanced or qualified signature is appropriate depends on the document.

How much should a small notarial practice spend on IT? It depends heavily on size and service level. As a guideline for a small practice: €40 to €90 per user per month for a managed digital workplace, plus notarial software and a client portal per module. One-off costs for the KNB programme (baseline assessment, policy, training) realistically range from a few thousand euros to the low five figures, depending on your starting point.

What is the minimum I need to arrange for backup to comply with the KNB code? Daily and weekly backups made using different methods, a minimum of 30 days' retention and periodic verification. In practice, add an immutable or offline copy to cover ransomware, and rehearse a real restore at least twice a year.

Conclusion

IT for a notarial practice is no longer a simple tick-box exercise. The KNB Code of Conduct on Information Security requires demonstrable compliance, the Wwft demands watertight customer due diligence with a complete audit trail, the GDPR still applies in full and the cyber threat level for professional services remains high. The good news: it's manageable, provided you treat it as an annual cycle rather than a one-off project.

As an IT partner, TRON Group works with notaries and other legal professionals to balance the code of conduct with day-to-day workability: baseline assessment, managed digital workplace, KNB-compliant backup, awareness training and an annual supplier audit included. Want to know where your practice stands and what your next step should be? Take a look at our approach on our page about IT for notaries or call +31 85 303 5869 for a no-obligation chat. Moving IT Forward, in the notarial sector too.