Jeroen van Helden

Jeroen van Helden

Senior Associate | Attorney at law

IT, Privacy & Cybersecurity

Jeroen van Helden acts as lead counsel in matters concerning IT transactions and IT disputes. He also advises clients in the event of cyber attacks and cyber incidents. Jeroen has specific expertise in software licensing, data protection, IT contracts and compliance issues, and enjoys sharing his IT law knowledge and enthusiasm for his field through professional journals, seminars and courses.

Jeroen works a great deal for IT companies ranging from cloud service providers, app builders and managed service providers, to cybersecurity experts. On the buyer side, he frequently works for government authorities, international organisations and companies in the education, healthcare and transport sectors. He is just as enthusiastic about engaging with a CEO on a strategic matter as he is about working with in-house counsel on a complex case. He takes a result-oriented, meticulous and discreet approach to his work.

Education

Jeroen studied Law at the University of Amsterdam and the University of Michigan, graduating cum laude. In 2022, he successfully completed the Grotius specialist programme in Information Technology Law (also cum laude) and in 2023 the specialist programme in Cybercrime & Cybersecurity at Leiden Law Academy.

Career

During his studies, Jeroen worked as a coach in European legal history, gained experience at a law firm in The Hague, and learnt website programming. After earning his Master’s degree, he worked for the government for several years as an IT lawyer, before joining the De Clercq technology team in 2018.

Jeroen's daily practice

Jeroen’s daily practice involves providing advice and litigating in the field of IT law on matters such as transactions for cloud services (SaaS, PaaS, IaaS), the implementation of ERP systems, or complex international privacy issues. He has extensive experience in resolving IT-related disputes, whether by mediation or arbitration, or before the public courts. He is also frequently called upon to assist in the event of major cyber attacks or other cyber incidents, including ransomware attacks, DDoS attacks, CEO fraud, or theft of trade secrets.

Selected cases

Lead counsel for an international organisation in relation to multi-million euro transactions for the use of Google Cloud and AWS (IaaS, PaaS).

Providing advice to a major Dutch e-learning provider regarding a transaction for using a learning management platform (PaaS, SaaS).

Lead counsel for a Dutch software developer with respect to transactions with various research institutions and technology companies in countries such as the U.S., Australia and Switzerland.

Providing advice to a managed service provider in the wake of a major ransomware attack.

Representing a Dutch IT company in a court case relating to a failed agile software development project, which resulted in the plaintiff’s claim of over a million euros being dismissed.

Providing advice to a Dutch company involved in a dispute with an American technology company about matters including unilateral modification of the licence metrics of a low-code platform.

Representing a Dutch/Spanish retailer in international mediation proceedings concerning a failed ERP implementation, resulting in damages from both the software supplier and the implementation partner.

Providing advice to a Dutch SaaS provider on the status of a SaaS solution developed for use in hospitals, under the Medical Devices Regulation (MDR).

Providing advice to an international organisation regarding defence against a multi-million euro claim filed by a U.S. software vendor relating to additional use of on-premises software in connection with a data centre migration.

Representing a Dutch government organisation in a historical arbitration case concerning a failed IT project. It resulted in the recovery of tens of millions of euros from the IT supplier for the benefit of the Dutch taxpayer.

Stay up to date

The latest developments

IT, Privacy & Cybersecurity

The Government Is Building Its Own Cloud: What This Means and Why It Matters to You

19 October 2026

Three companies—Google, Amazon and Microsoft—together account for 70% of the European cloud market. European providers each hold a market share of approximately 2%. This is more than just a market statistic. It reflects a balance of power that directly affects who can, in practice, access the data held by Dutch public sector organisations and which laws govern that access. The Dutch government has decided that this needs to change. In a memorandum published in June 2026, the Ministry of the Interior and Kingdom Relations’ NDS Cloud Programme explains how the government intends to build its own sovereign cloud service. The document is concrete in its approach, setting out a timeline, a selected scenario, a technical strategy and an honest acknowledgement of the challenges involved.

Read more

IT, Privacy & Cybersecurity

When Is a Cloud Service Truly Sovereign?

5 October 2026

Almost everyone claims to offer a “sovereign” or “autonomous” cloud solution. Dutch hosting, European data centres, full GDPR compliance. The promises are impressive. The question is whether they actually mean anything.

Read more

IT, Privacy & Cybersecurity

Digital Sovereignty as a Public Procurement Criterion: What Is Already Possible?

16 September 2026

In our previous blog post, we discussed vendor lock-in and contractual safeguards. However, contractual protections only work if you still have freedom of choice when signing the agreement. That freedom begins with the procurement process: the point at which a public contracting authority decides what to purchase and from whom. The question, then, is whether procurement law allows digital sovereignty to be taken into account when awarding IT contracts. The answer is yes - and there is more scope to do so than many contracting authorities realise.

Read more
View all blogs