DigiD Data Rules Get Stricter

The Dutch cabinet wants stricter rules for companies involved in managing DigiD data.

DigiD is the login system used by millions of people in the Netherlands to access government services, health insurance portals, tax information, benefits, pensions and municipal services.

That makes it one of the most sensitive digital systems in the country. If people cannot trust DigiD, trust in digital government is damaged too.

The new rules are meant to reduce the risk that citizens’ personal data could fall within reach of foreign governments. The cabinet wants companies handling DigiD infrastructure to show that sensitive data is protected against unwanted foreign access.

The debate became more urgent after Solvinity, a Dutch company involved in DigiD infrastructure, was taken over by the American company Kyndryl. The concern is not only about one company. It is about whether foreign ownership can create legal risks when another country has laws that may allow access to data held by companies based there.

Why DigiD matters

DigiD is not just another login button. It is part of the public trust system of the Netherlands. People use it for taxes, healthcare, student finance, childcare benefits, residence matters and many other official services.

The government says the issue is not simply whether a company is Dutch, European or American. The key question is whether the country behind a company could demand access to sensitive public data.

That makes the discussion part of a wider debate about digital sovereignty. The Netherlands and the EU depend heavily on large foreign technology companies for cloud services, digital infrastructure and government systems. That dependence can become risky when public data is involved.

What may change

The stricter procurement rules are expected to matter for future DigiD contracts. A company that wants to manage parts of the system may have to prove that personal data is protected from unwanted foreign access.

The challenge is to make the rules strict enough to protect citizens, but still workable for companies that provide complex digital infrastructure.

The technical details may be hard to follow. The practical point is simple: DigiD is used for some of the most personal interactions between residents and the state. That is why the question of who manages the data matters.