The next company to manage DigiD’s infrastructure must be European, and the Dutch government is already drawing up the rules to make sure of it.
State Secretary Eric van der Burg confirmed this requirement in a letter to the Tweede Kamer on June 4.
This couldn’t have come at a more pertinent time, given that the Netherlands recently blocked the takeover of Solvinity, the company running DigiD’s infrastructure, by US tech giant Kyndryl.
Before the block, the Dutch government endured months of parliamentary panic about who (or which foreign government) might end up with access to the system that millions of residents use daily to log in to everything from the Belastingdienst to their health insurer.
Here’s why only European companies can bid
Logius, the government agency that manages DigiD, will run the next tender under the Aanbestedingswet Defensie en Veiligheid (ADV), a procurement process designed for defence and security-sensitive contracts.
Unlike a standard European tender, the ADV allows the government to restrict bidders by country.
This means that countries whose laws allow their governments to compel tech companies to hand over data, like the US, are out.
And that’s not a hypothetical concern, either. When American firm Kyndryl tried to acquire Solvinity, the company couldn’t guarantee that US legislation (including the Cloud Act) wouldn’t give Washington control over Dutch digital government.
Security upgrades are coming too
Needless to say, blocking one dodgy acquisition doesn’t fix underlying vulnerabilities.
A confidential audit Logius completed at the end of 2025 flagged four areas of concern:
- encryption,
- monitoring,
- network security,
- and access management.
According to Logius, they are considering a range of tailored fixes across these areas, from covering additional encryption, adjustments to task responsibilities, and expanded logging and monitoring. However, the exact measures will vary by platform.
Monitoring across Solvinity’s platform is also being expanded, with oversight centralised under the Logius Security Operations Centre.
And the Netherlands isn’t alone in bolstering security, either.
The EU announced this week that it intends to push member states toward European providers for large government digital contracts, weighing the origin of technology alongside price and quality.
Want to make sure DutchReview pops up on your news feed more often? Just add us as a preferred news provider, and we’ll handle the rest.
