Dutch Government Restricts DigiD Platform Operations to European Companies

National Security Mandate for DigiD Operations

The Dutch government has announced that any future company managing the DigiD platform must be based in Europe. State Secretary Eric van der Burg of Interior detailed this requirement in a letter to parliament, specifying that the tender for contracts following August 2028 will be conducted under the Defense and Security Procurement Act (ADV).

This policy shift is designed to limit national security risks by utilizing the ADV, which provides broader authority than standard European tenders to restrict eligibility to European companies. The primary objective is to ensure that the management of the national identity system remains outside the reach of non-European legal jurisdictions.

Blocking the Kyndryl Acquisition of Solvinity

The decision follows the Dutch Cabinet's recent block of an attempt by the American company Kyndryl to acquire Solvinity, the current partial manager of DigiD. The block was implemented following advice from the Investment Review Office (BTI).

Parliamentary concerns centered on the potential for the U.S. government to gain access to DigiD data or shut down the platform via Kyndryl. While Solvinity officials stated they would attempt to prevent such outcomes, they could not guarantee that U.S. legislation—which allows the government to request data from American tech companies or intervene in their operations—would not override those safeguards.

Enhanced Data Encryption and Security

In addition to the residency requirements for operators, the State Secretary announced that data on DigiD and MijnOverheid will undergo improved encryption. These security enhancements are the result of recommendations from a non-public investigation conducted during the review of the Kyndryl-Solvinity acquisition attempt.

Community Perspectives on Digital Sovereignty

Discussion among technical observers highlights a broader debate regarding digital sovereignty and the reliance of government infrastructure on private contractors.

Concerns Over Outsourcing and Cloud Dependencies

Some observers question the efficacy of requiring a European operator if the underlying infrastructure remains dependent on non-EU providers. One commenter noted:

"Plot twist: the data will still be stored outside of the EU - the magic of cloud computing."

Others raised concerns about the potential for European companies to subcontract work to entities outside the continent, potentially bypassing the intent of the residency requirement.

Debate on Public vs. Private Infrastructure

There is significant discussion regarding why a critical national identity system is managed by private companies rather than being a government-run project. Comparisons were made to other European models, such as FranceConnect, with users questioning why the Dutch government does not fund and administer DigiD as a public infrastructure service.

Geopolitical Trust and Technical Capacity

Technical commentary suggests that true sovereignty requires more than just corporate residency, noting that the "smart parts" of the stack—such as processors and trusted computing—are rarely designed locally, making complete independence difficult without immense state capacity.