Custom legal document

Drafting a Pentest Waiver

Have it drafted, amended, or reviewed by our legal experts and/or lawyers starting from 99
SME Lawyers

Don't take a gamble on this: holes in a self-made document have major consequences.
Have a lawyer review it and save yourself doubt, setbacks, and exorbitant costs.

  • Truly Tailor-Made Legal Solutions
  • Fixed rates
  • Pay later after draft
  • Free adjustment round
  • Delivered within 5 working days
  • Express delivery possible
  • Available in Dutch and English

How does it work?
Our services include a free consultation, a draft document, a revision round, and a final document. We invoice after sending the draft document.

Experience with legal services for entrepreneurs since 2001
Lawyers and legal professionals.Direct contact with a specialist who thinks practically.
Fixed rates.Where possible, clarity regarding costs in advance.
Within 4 hoursWe respond quickly to your request.
  • We worked for, among others:
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner

We worked for, among others:

An incorrect document often provides a false sense of security.
You think everything is taken care of, but only discover whether the document actually works during a conflict or claim.

1

Free intake

We discuss your company, the purpose of the document, and the key risks.

2

Draft or check

We draft a custom document or review your existing document legally.

3

Final version

You will receive a final version with instructions on correct usage.

Mr. Jaime Boogaers
Mr. Jaime Boogaers
Corporate Law
Attorney, 16 years of experience

A legal document must not only be legally correct. Above all, it must align with how the entrepreneur will actually use the document

  • Lawyers and in-house counsel
  • Active since 2001
  • Affordable custom legal services
  • Always focused on practical use

Choose Tailored Legal Solutions

Choose whether you want to have the document drafted, checked, or modified. Prices and options vary per document.

From 99
Customization
from 99.- per document

Do you already have a document, but are unsure if it is still correct? We check content, risks, and practical usability.

from 249.- per document

Is your document outdated, copied, generated with AI, or no longer suitable? We check and adjust the document.

About us

Our expertise

Our lawyers and in-house counsel specialize in drafting, reviewing, and amending legal documents and contracts. We look not only at the legal text but also at how you use the document in practice.

Custom solutions for your industry

Every business operates differently. That is why we take your industry, customers, working methods, and specific risks into account.

Our facts

  • Active since 2001
  • Lawyers and in-house counsel
  • Fixed rates in advance
  • Tailored legal solutions for entrepreneurs
  • Thousands of agreements per year
  • Customization
  • About us
from 99.- per document

Do you already have a document, but are unsure if it is still correct? We check content, risks, and practical usability.

  • Our legal expert spends 0.5 to 1.5 hours on the check
  • Telephone intake with a lawyer
  • Checks on content, risks, and practical usability
  • Attention to liability, payment, and termination
  • Concrete points for improvement and legal advice
  • Delivered within 3 working days, express delivery possible
from 249.- per document

Is your document outdated, copied, generated with AI, or no longer suitable? We check and adjust the document.

  • Our legal expert spends 1.5 to 2.5 hours checking and making adjustments
  • Telephone intake with a lawyer
  • Verification of the existing document
  • Adaptation to your business and working methods
  • Suitable for new services, customers, or risks
  • Delivered within 5 working days, express delivery possible

About us

Our expertise

Our lawyers and in-house counsel specialize in drafting, reviewing, and amending legal documents and contracts. We look not only at the legal text but also at how you use the document in practice.

Custom solutions for your industry

Every business operates differently. That is why we take your industry, customers, working methods, and specific risks into account.

Our facts

  • Active since 2001
  • Lawyers and in-house counsel
  • Fixed rates in advance
  • Tailored legal solutions for entrepreneurs
  • Thousands of agreements per year

Reviews (21)

Yara

We received excellent assistance with our legal questions. The entire process felt like a co-creation rather than a one-sided assignment. A reliable partner who strives for perfection in their documents.

Burak

The communication was smooth and professional. A perfect balance was struck between protecting our business and not deterring customers. The end result aligns 100% with our high standards.

Danielle

The lawyer took the time to explain everything thoroughly. The lawyer always maintained an overview, even when the wish list changed in the meantime. Everything was delivered neatly and on time.

Meryem

The direct translation of our problem into a legal solution was impressive. The adjustments were logical and carefully incorporated. These documents will undoubtedly save us a lot of headaches in the future.

Rob

No waiting times or endless menus; we got someone on the line immediately. The expertise regarding privacy and GDPR was clearly noticeable and up-to-date. The end result aligns 100% with our high standards.

Aya

Communication was direct and efficient, exactly what we were looking for. The language in the contract was modern and clear, without archaic terms. The quality fully met our expectations.

Bass

The lawyer took a practical approach with our company. They flawlessly exposed the pain points in our current contract. The document was accepted flawlessly by our investors.

Yusuf

The working method was clear from the start. The empathy and understanding of the lawyer made this a very pleasant collaboration. A party that delivers on what it promises on its website.

Ziad

We immediately got the right expert on the line for our specific problem. The lawyer was not afraid to be critical of our own initial plans, which saved us from mistakes. The service was professional and personal.

Koen

Quick response and clear explanation. It was nice that they didn't charge by the hour for a simple extra question. Our business partners were impressed by the professionalism of the contracts.

Thijs

The review of the document was thorough. The flexibility to add an extra provision at the last minute was highly appreciated. The document was accepted flawlessly by our investors.

Wilco

The friendly approach immediately put us at ease. We received not only a document, but also a corresponding manual for its use. The document was flawlessly accepted by our investors.

Mina

The lawyer got straight to the heart of the matter. The documents are written in such a way that they grow with the future of our company. Everything was delivered neatly and on time.

Zakaria

We came in with a vague idea, but were immediately presented with concrete steps. We received valuable tips on how to present the documents to our clients in practice. The quality fully met our expectations.

Amani

They really thought along with our situation. The contact was approachable and professional. A reliable partner that strives for perfection in their documents.

Sofiane

We were given the space to tell our entire story without being interrupted. The proactive approach went beyond just the legal framework; the business side was also addressed. Our business partners were impressed by the professionalism of the contracts.

Lieke

The consultation provided immediate clarity. The lawyer needed only half a word to create the right context. A party that delivers on what it promises on its website.

Jurre

We quickly gained the certainty we were looking for. The concept was clear and practically applicable. The service was professional and personal.

Fouad

I couldn't see the wood for the trees, but the first meeting immediately provided clarity. The corrections were implemented lightning-fast in the new version every time. The document was accepted flawlessly by our investors.

Ibrahim

We really appreciated the transparency regarding the costs upfront. The aftercare and the opportunity to ask brief questions were perfectly arranged. A reliable partner that strives for perfection in their documents.

Anouar

Scheduling the appointment went very smoothly and quickly. The legal language was strict and forceful where necessary, but lenient where possible. It is clear that they have a passion for entrepreneurship.

Meet our office

Our ContractCheck, simply explained what can all go wrong.

Why MKB Juristen?

Since 2001, we have been active as a no-nonsense legal firm for entrepreneurs. We quickly get to the heart of the matter: with a thorough assessment, clear answers, and a document that works practically.

  • Nationwide coverage
  • First consultation free and without obligation
  • Fixed rates where possible
  • Affordable legal advice from lawyers and legal experts
  • Always a response within 4 hours

First, see how we work

A legal document requires trust. You see immediately who we are, how we help entrepreneurs, and why we do not work with standard templates.

  • You can view our working method before submitting an application
  • You will get a feel for the office and the people faster
  • The video supports the choice for customized legal solutions
  • After that, you can immediately request a quote or intake

What you can expect from us

We translate your situation into a legal document that you can actually use. You won't receive a loose template, but a document tailored to your business, agreements, and risks.

  • A clear roadmap: intake, concept, revision round, and final version
  • Practical explanation on how to use the document
  • Legal attention to liability, payment, and termination
  • Where possible, provide clarity in advance regarding price and delivery time
Are you unsure whether you should have the document drafted, checked, or amended?
During the initial consultation, we will determine the sensible course of action together. Afterward, you will know exactly where you stand.

Why customization?

A legal document only works well if it aligns with your business, agreements, risks, and industry. That is why we do not work with a standard generator, but with legal experts who assess your situation.

  • Prepared for your company
  • Telephone consultation included
  • No standard template
  • Review by legal specialists

What do you get?

You will receive a legal document that is practical and aligns with the agreements you wish to make.

  • Draft document or legal review
  • One adjustment round
  • Clear explanation where necessary
  • Fixed price where possible

The founders of MKB Juristen

Our organization consists of several small teams working within various legal fields. Each legal field has its own senior in-house counsel and/or lawyers.

Denian Wielhouwer

Corporate lawyer in corporate law & business expert

Denian Wielhouwer

Annelore Hendriks

Corporate lawyer, corporate law, administrative law

Annelore Hendriks

Ilja van Driel

Corporate law attorney, employment law

Ilja van Driel

Jaime Boogaers

Corporate law, ICT & privacy law, energy law attorney

Jaime Boogaers
Custom choices

Which choices determine the content?

The content of a pentest waiver depends on the type of test, the systems, and the risk appetite of the client. The questions below help you choose the right scope.

Choice or question Why this matters legally
Which systems may be tested? Determines the scope; only own systems, or also systems running at a hosting provider or cloud provider for which separate permission is required.
Is testing being done in production or in a test environment? Production testing requires stricter agreements regarding downtime, backups, and an emergency stop procedure than testing in a shielded environment.
Is social engineering or phishing allowed? Approaching employees touches upon privacy and employment relations and requires explicit consent and clear boundaries.
Could personal data be affected? If so, the waiver must comply with GDPR provisions, and an additional data processing agreement is often required.
How is liability divided? Determines whether the tester is indemnified for damages within the scope and what liability the tester retains in the event of gross negligence.
Clauses and provisions

What components belong in a pentest waiver?

A good pentest waiver describes not only that testing is permitted, but, more importantly, within what limits. The components below ensure that both the client and the tester know where they stand and that the consent holds up legally.

Provision Relevant to Legal point of attention
Parties and jurisdiction Always Name the client and the tester and confirm that the signatory is authorized to grant consent for the systems to be tested.
Consent and justification Always Explicit permission to attack defined systems, so that actions are not classified as computer intrusion.
Scope and systems Always Exhaustive list of IP addresses, domains, applications, and accounts included in the test, with explicit exclusions.
Test methods and limitations Always Which techniques are permitted (black box, white box, social engineering, DoS) and which are expressly not.
Time window Always Start and end dates and any allowed time blocks, so that the test does not coincide with critical business processes.
Liability and indemnification Highly recommended Allocation of risk in the event of damage, downtime, or data loss and any limitation or indemnification between the parties.
Confidentiality of findings Always Obligation to treat discovered vulnerabilities and data confidentially and to report them only to the client.
Processing of personal data If applicable Agreements regarding the processing of personal data during the test and who acts as controller and processor.
Use in practice

How do you use this document correctly?

A pentest waiver is only effective if it is signed in advance and actually covers the test performed. Follow the steps below to ensure the consent remains legally binding.

Situation What should you do? Point of attention
Before the start of the test Have the waiver signed by both parties before any test activity takes place. Retroactive consent does not remedy a computer intrusion that has already been committed.
When using external systems Request additional permission from the hosting or cloud provider and include it. You can only grant permission for systems over which you have control.
During the test Adhere strictly to the defined scope and time window, and log all actions. Actions outside the scope fall outside the consent and may be unlawful.
Upon completion Keep the signed waiver with the test report and the logging. In the event of a dispute or damage, you must demonstrate that the work was carried out within the agreed limits.
Common mistakes

Common mistakes

Most problems surrounding a penetration test do not arise from the test itself, but from a careless waiver. Watch out for the following common mistakes.

Wrong Consequence Better approach
No or verbal consent In the event of damage or a complaint, proof of consent is difficult to obtain, and there is a risk of being charged with computer trespass. Always record the consent in writing and signed before the test starts.
Vague or unlimited scope The tester inadvertently touches systems or data, resulting in downtime or a data leak. Name systems, IP addresses, and exclusions exhaustively and concretely.
Granting permission for third-party systems The waiver does not cover the supplier, who can file a report themselves or block the test. Arrange separate permission from hosting and cloud providers in advance.
Liability not settled In the event of damage to production systems, it remains unclear who bears the costs. Explicitly divide liability and align it with the insurance.
Confidentiality of findings forgotten Found vulnerabilities leak out before they are fixed. Include a confidentiality obligation and arrange for secure reporting.
Risk profile

What is your situation and what do you pay attention to?

The key considerations of a pentest waiver vary depending on the situation. If you recognize your situation below, you will see where the emphasis should lie.

Risk profile Example Focus in the document
You have your own web application tested An external party tests an application managed by you on a test environment. Clear scope and an emergency stop procedure in the event of unexpected failure.
You are testing in a production environment The test touches live systems with real customer and business data. Agreements regarding downtime, backups, monitoring, and liability.
You are the testing party yourself As a security company, you perform a penetration test for a client. Confirmation that the client is authorized and an indemnification within scope.
The test involves personal data During the test, the tester may come into contact with personal data. Compliance with the GDPR and a data processing agreement with confidentiality.
Additional documents

When is this document not enough?

A pentest waiver governs the consent and limits of a test, but does not cover broader collaboration or data processing. You will need additional documents in the following situations.

Situation Supplementary document Why
Situation Related document Explanation
The tester processes personal data on your behalf Data Processing Agreement Mandatory under the GDPR as soon as the tester, acting as a processor, touches upon or views personal data.
You want to protect confidential information more broadly Confidentiality Agreement Establishes the confidentiality of commercially sensitive information beyond only the test findings.
The penetration test is part of an ongoing collaboration Cooperation Agreement Regulates the broader agreements, rates, and responsibilities of the structural cooperation.
Explanation of this document

Drafting a pentest waiver, why?

Not every entrepreneur knows exactly what pentest waivers are, when they are needed, and which risks they must cover. Therefore, we explain below what this document entails, what to look out for, and why customized legal solutions are important.

What is a pentest waiver?
A pentest waiver —also known as a penetration test authorization document or ethical hacking agreement—is the document by which the owner of an IT system, network, or application explicitly grants a penetration tester (pentester) permission to test the security of that system in a controlled manner. Without a pentest waiver, a penetration test can be a criminal offense under Articles 138ab and 350 of the Dutch Criminal Code: unauthorized access to computer systems and damaging data are criminal offenses, even if the tester has good intentions. The pentest waiver creates the legal framework for legitimate security testing: it defines the scope of the test, the permitted methods, the time period, the communication procedure, and the handling of discovered vulnerabilities. Our lawyers will draft a pentest waiver for you that accurately describes the scope, gives the pentester sufficient room to test effectively, and protects you as the owner against unintended damage during the test.
What elements must a pentest waiver contain?
A legally sound pentest waiver contains at least the following elements. The identity of the parties: the system owner and the pentester or the pentesting company. The scope of the test: which systems, IP addresses, domains, and applications may be tested, and which are expressly excluded? The permitted test methods: which techniques are allowed — social engineering, phishing, vulnerability exploitation, denial of service — and which are prohibited? The time period: from when to when may the test take place? The line of communication: who is the contact person at the owner who is available 24/7 if the pentester discovers a critical vulnerability requiring immediate attention? The reporting: in what format is the test report delivered, within what timeframe, and how are found vulnerabilities classified? And the liability arrangement: in the event of unintended damage during the test — a server going down due to a test — who bears the risk? Our lawyers draft a pentest waiver that adequately protects both parties.
How do you handle the processing of discovered vulnerabilities?
The most sensitive part of the pentest waiver is the responsible disclosure: the agreement on how discovered vulnerabilities are communicated and handled. The pentester is obliged to report discovered vulnerabilities exclusively to the owner and not to disclose them to third parties or the public. The owner commits to remedying the vulnerabilities within an agreed timeframe. Your waiver must also regulate the handling of highly critical vulnerabilities: if the pentester discovers a critical vulnerability requiring immediate action, they must inform the owner immediately — outside of the normal test report. Our lawyers draft a responsible disclosure clause that protects information security.
How does it work at MKBjuristen?
After a brief consultation regarding the systems to be tested, the scope, and the desired test methods, our lawyers draft a pentest waiver that accurately describes the scope, gives the pentester sufficient leeway, and protects you as the owner against unintended damage.
Are you unsure whether your document is legally correct? We would be happy to assess the sensible course of action: drafting, reviewing, or amending.
Request a quote

Why not use a standard document?

A standard document often seems like a quick solution, but usually does not fully align with your company, agreements, risks, and way of working. Our legal experts draft documents that fit your situation.

Standard document
SME Lawyers
Not tailored to your business
Tailored to your company, industry, and working methods
No control over your specific situation
Consultation with a lawyer and assessment of your risks
Possibly outdated or incomplete
Verification of current and practical provisions
No personal explanation
Explanation regarding the use of the document

A standard document seems cheap, until it doesn't fit your situation properly. That is why we provide custom legal solutions tailored to your business.

Custom solutions per industry and company

Every business operates differently and faces different legal risks. Therefore, we tailor the document to your industry, customers, agreements, and way of working.

Webshops & e-commerce

Focus on online sales, delivery, returns, complaints, payment, digital products, and consumer regulations.

Business services

Attention to the assignment, additional work, liability, payment, termination, and reliance on client information.

Construction, installation & execution

Attention to planning, delivery, warranties, additional work, materials, delays, and liability risks.

Software, SaaS & digital services

Attention to licenses, availability, support, updates, data, intellectual property, and limitation of liability.

Trade, supply & wholesale

Attention to delivery, transport, payment, retention of title, warranties, delivery times, and international agreements.

Consultants, freelancers & advisors

Attention to scope, best efforts obligations, cancellation, payment, liability, and confidential information.


A legal document only has value if it suits your practice. That is why we look not only at the text, but also at how you use the document in your business.

Common mistakes with legal documents

A legal document often seems simple, but small errors can have major consequences later on. In practice, we see that entrepreneurs run the greatest risk when a document does not align well with their business, agreements, or way of working.

  • Using a standard document that does not suit the company
  • Forgot important agreements regarding payment, delivery, liability, or termination
  • Have a document generated without legal review
  • Continuing to use old documents while the company has changed
  • Not knowing how the document should be used correctly in practice

A legal document only prevents problems if it suits your situation. That is why we look not only at the text, but also at your company, agreements, and risks.

Why is a standard document often not enough?

Because a standard document does not take into account your industry, customers, risks, and specific agreements, important provisions may be missing or not align well with your practice.

Can I create a legal document myself using AI?

AI can assist in creating text, but does not independently assess whether the document is legally appropriate, complete, and usable for your business. Legal review therefore remains important.

When do I need to have my document checked?

Have your document checked if your business has changed, you have new customers or services, you have doubts about existing agreements, or the document has not been updated for a long time.

Will I also receive an explanation about the use of the document?

Yes. We explain how to use the document in practice, what to look out for, and which steps are important to prevent disputes afterwards.

Contact us

Annelore Hendriks

Want to know more about our services?
Then contact our specialists.

Newsletter for entrepreneurs

Receive practical legal tips in your mailbox

Register now

Enter your email address and receive our newsletter.

No spam. Only legal tips.
By registering, you agree to our privacy statement.
SME Lawyers at the Chamber of Commerce Source: Chamber of Commerce 2019
Free consultation