Update 14 April 2026: article reviewed; powers and limitations (Wpbr, GDPR, art. 138ab/139a Sr) remain fully current.

A licensed detective agency in the Netherlands may do a great deal — but not everything. The legal boundaries are determined by the Private Security Organisations and Detective Agencies Act (WPBR), the General Data Protection Regulation (GDPR) and general private law. This article explains what a licensed detective agency may legally investigate, which types of evidence are admissible in court and where the limits lie.

What is a licensed detective agency?

A licensed detective agency holds a POB licence (Private Investigators and Security Agencies) from the Ministry of Justice and Security. In the Netherlands, these licences are issued and registered by Justis, the screening authority of the ministry.

Without a POB licence, an agency or person may not call themselves a detective agency or carry out detective activities. SAJ Recherche’s licence number is 8779, valid until 01-07-2030.

You can verify any detective agency via the public WPBR register at justis.nl.

What may a detective agency investigate?

A licensed detective agency may carry out the following investigative activities on the basis of a legitimate interest:

Observation and surveillance: Following and photographing persons in public places is permitted. Observation on private property requires special circumstances and must always be proportionate to the interest at stake.

OSINT investigation (Open Source Intelligence): Collecting and analysing information from public sources: social media, company registers, land registry, court rulings, news archives and other publicly accessible sources.

Background investigation: Verification of identity, qualifications, employment history and references — provided the person being investigated has given consent (such as in pre-employment screening) or a legitimate interest exists.

Fraud investigation: Investigation into expense fraud, embezzlement, invoice fraud and other forms of internal fraud — on behalf of the employer, in accordance with GDPR.

TSCM inspections: The professional detection of hidden surveillance equipment at locations that the client lawfully occupies.

Alimony investigation: Establishing whether a person receiving alimony is cohabiting with a new partner as if married (Art. 1:160 Dutch Civil Code).

What may a detective agency NOT do?

The following actions are not permitted — even for a licensed detective agency:

Hacking into computers, phones or email accounts (Art. 138ab Sr)
Illegal tracking via GPS without the consent of the vehicle owner
Placing listening devices (Art. 139a Sr)
Searching post or parcels
Assuming a false identity to obtain information (exception: mystery guest under strict conditions)
Breaking into buildings or vehicles

When is evidence from a detective agency admissible in court?

Evidence is admissible when it is:

Proportionate: The investigative method is proportionate to the interest at stake
Subsidiary: There is no less intrusive way to gather the evidence
GDPR-compliant: Personal data has been handled carefully
Based on a legitimate interest or consent
Collected by a licensed agency: The POB licence gives evidentiary weight

Evidence gathered by an unlicensed agency or through illegal methods can be excluded by the court — even if the content is accurate.

What is the difference between licensed and unlicensed?

	Licensed agency (POB)	Unlicensed agency / freelancer
Legal evidence	Admissible in court	Risk of exclusion
GDPR compliance	Verified	Not guaranteed
Professional liability	Compulsorily insured	Not regulated
Complaints procedure	Via Justis	No legal framework
Duty to identify	Mandatory	Not applicable

Proportionality and subsidiarity in practice

Every detective investigation must comply with two core principles:

Proportionality: The investigation may not be more severe than the interest it serves. Multi-day surveillance of an employee is not proportionate if a simple conversation would have sufficed. SAJ Recherche assesses each request in advance.

Subsidiarity: The investigation may only be carried out if there is no less intrusive way to achieve the goal. If an administrative check suffices, surveillance is not subsidiary.

Official sources

Private Security Organisations and Detective Agencies Act (WPBR) — wetten.overheid.nl
WPBR register Justis — justis.nl/producten/wpbr
GDPR (General Data Protection Regulation) — autoriteitpersoonsgegevens.nl
Dutch Criminal Code, Art. 138ab (computer intrusion) — wetten.overheid.nl

SAJ Recherche B.V. holds POB licence 8779, issued by the Ministry of Justice and Security. This article is for informational purposes and does not constitute legal advice.

What can a licensed detective agency legally investigate?