MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
Having a pentest waiver drafted by a specialized lawyer typically costs between 500 and 1,500 euros, depending on the complexity of the test and the number of parties involved. For that price, you receive a document that makes the test legal: watertight consent, a clear scope, an indemnity for the pentester, and the correct GDPR provisions. Because unauthorized intrusion is a criminal offense under Section 138ab of the Dutch Criminal Code, the quality of the waiver is a determining factor regarding the risks. Below are the costs, the process, and what to look for when choosing an advisor.
The short answer
- Costs: approximately 500 to 1,500 euros, more for third-party systems and personal data.
- Process: intake, define scope, check consent chain, draft, signing.
- Lead time: usually a few days to two weeks.
- Do it yourself: possible for a simple internal test on your own systems.
- Who: a lawyer with knowledge of IT law, liability, and the GDPR.
When to have a pentest waiver drawn up?
You have a pentest waiver drawn up as soon as the test involves more than an internal check on your own, fully self-managed systems. If third-party systems, customer data, a production environment, or an external pentester are involved, the quality of the waiver determines whether the test is legal and who bears the risk. Without consent, the test falls under computer trespass, Article 138ab of the Dutch Criminal Code, and an overly broad or unclear scope can cause problems for both the client and the pentester. A legal expert ensures that the consent chain is correct, the scope is clear, and the GDPR aspect is covered. For a simple internal test, a concise declaration will suffice.
What determines the price
The costs depend on a few factors:
- Number of parties: if the systems run with a hosting provider or cloud service, consent from multiple parties must be arranged.
- Personal data: if the test involves customer data, GDPR provisions and often a data processing agreement apply.
- Scope: more systems, applications, and methods require a more extensive definition.
- Risk profile: a test on a production environment or critical systems requires more careful agreements regarding damage and repair.
Expect to pay between 500 and 1,500 euros for an average pentest waiver. A simple waiver for an internal test is at the lower end, while a test involving third-party systems, personal data, and a production environment is at the higher end.
The process step by step
- Intake: the legal expert maps out which systems are being tested, by whom, and for what purpose.
- Consent chain: check who the rights holder is and whether a hosting provider or cloud service also needs to give consent.
- Define scope: define the systems, methods, exclusions, and time window together with the pentester.
- Concept: the legal expert drafts the waiver including the indemnification, liability, and GDPR provisions.
- Signature: Authorized signatories of the rights holder, the hosting party (if applicable), and the pentester sign before the test starts.
An example. A software company wants to have its application, which runs in an external cloud, tested. During the intake, it turns out that the cloud service provider must grant separate permission, something the company itself had overlooked. The legal expert arranges this permission and sets up the scope so that the shared infrastructure remains outside the test. This ensures the test is conducted legally.
What to look for when choosing an advisor
Pay attention to the following when making your choice:
- Knowledge of IT law: computer intrusion, liability, and the GDPR must come together in a single document.
- Experience with penetration tests: an advisor who knows the practical side and knows which scope agreements and exclusions are necessary.
- Fixed price: many lawyers offer a fixed price for a standard waiver; ask about this.
- Attention to the consent chain: this is the part that is most often overlooked and poses the greatest risks.
Honest recommendation
For a simple, internal test on systems you manage entirely yourself, without personal data and without third-party systems, you do not need to engage a lawyer. A concise, signed consent form with a clear scope, a time window, and the appropriate signing authority will suffice.
As soon as third-party systems, customer data, a production environment, or an external penetration tester are involved, having a pentest waiver drafted almost always pays for itself. The advisor ensures that the consent chain is correct, the scope is clearly defined, and the GDPR side is covered, so that the test proceeds legally and the risks are clearly distributed. Missing consent from the hosting provider or an overly broad scope can lead to criminal or civil liability, which costs many times the fee. Request a fixed price in advance and have the advisor check the consent chain specifically.
More about the explanation and content: pentest waiver, what is a pentest waiver and drafting a pentest waiver.
Frequently Asked Questions
With a specialized lawyer, it typically costs between 500 and 1,500 euros, depending on the complexity. A simple waiver for an internal test is at the lower end, while a test involving third-party systems, personal data, and a production environment is at the higher end.
Typically a few days to two weeks. Most of the time is spent defining the scope and arranging the consent chain when a hosting provider or cloud service is involved.
For a simple internal test on your own systems, a concise declaration may suffice. As soon as third-party systems, customer data, or an external penetration tester are involved, a customized approach is advisable, as an error in the consent or scope can lead to liability or criminal prosecution.
The consent chain. It is often forgotten that a hosting provider or cloud service must grant separate consent for systems running on their infrastructure. Without that consent, you are testing on a third-party system, and the test is not legal.
A legal expert with knowledge of IT law, where computer intrusion, liability, and the GDPR converge, and preferably experience with penetration testing. Who knows which scope agreements, exclusions, and indemnities are necessary in practice.
An authorized signatory of the rights holder and the pentester, and for systems running at a third party, that party as well. The signatures must be in place before the test starts, because consent must be established in advance.
If the test involves personal data, usually yes. The penetration tester then processes data on behalf of the client, which under the GDPR requires a data processing agreement and appropriate security pursuant to Article 32 of the GDPR. The legal expert includes this in the waiver.
