Netherlands aims to eventually host DigiD on its own government cloud

The Dutch cabinet wants to host DigiD on a sovereign government cloud in the longer term, with the platform, infrastructure and data centres all under its own control. State Secretary Van der Burg expressed that preference in responses to parliamentary questions from JA21 MP Van den Berg, who asked about digital dependencies surrounding the login service.

No concrete timeline has been given. The cabinet's wording and the current state of the exploration suggest that a fully sovereign government cloud is not imminent. The Ministry of Economic Affairs is still investigating what such a cloud should even look like.

In the meantime, DigiD will remain in the hands of commercial hosting parties. At present that is Solvinity, a Dutch hosting company whose current contract runs until 2028. That contract duration plays a direct role in the debate, after the cabinet earlier this year blocked a planned acquisition of Solvinity by US firm Kyndryl on national security grounds.

Acquisition blocked, tender approaching

The blocked Kyndryl deal illustrates how politically sensitive the hosting of DigiD is. DigiD is the central login facility for virtually all digital government services in the Netherlands, with tens of millions of users. Bert Voorbraak, director general of Logius, the government organisation that develops and manages DigiD, stressed in response to the commotion that DigiD is Dutch and will remain so.

Logius is already preparing for a new tender. This will fall under the Defence and Security Procurement Act, a legal framework that provides more room to weigh security considerations than a standard European tender. Specifically, that act makes it possible to exclude non-EU companies from becoming the future host of DigiD.

What DigiD manages and what it does not

A common misconception is that DigiD itself stores sensitive personal data. That is not the case. When a user logs in, the service provides only an encrypted citizen service number (BSN), which grants the user access to a government organisation. Data on income, health or benefits is held by the relevant implementing organisations themselves, not by Logius.

That does not alter the fact that the availability and integrity of DigiD as a gateway are of great importance. A disruption or unauthorised access to the authentication service directly affects access to the entire digital government.

Transfer takes time due to bespoke nature

Should the tender result in a new management party, the cabinet anticipates a transition period of six to twelve months. DigiD is technically a bespoke system: knowledge of how it operates is highly specific and not straightforward to transfer. That lead time is a factor in planning around the expiry of the Solvinity contract in 2028.

The Dutch Cloud Community, an industry association focused on digital sovereignty, has made its concerns about the situation known to the government and has offered to contribute to discussions on the future setup.

Sovereignty as a guiding principle, implementation uncertain

The intention to eventually run DigiD on a sovereign government cloud fits within a broader political movement, both in the Netherlands and across Europe, to make critical digital infrastructure less dependent on foreign, particularly American, technology companies. The European Commission is working on comparable frameworks, including the EU Cloud Rulebook and initiatives around GAIA-X.

At the same time, the DigiD case illustrates how difficult that ambition is to realise in practice. A sovereign government cloud requires not only political will, but also technical capacity, sufficient scale and a market of European providers capable of meeting stringent requirements. As long as that infrastructure does not exist, the government will remain dependent on commercial parties. For Dutch cloud providers and investors in digital infrastructure, this signal from the cabinet underlines that the public sector is seriously looking for alternatives, though the question of when and how that demand will translate into concrete contracts remains open.