Netherlands restricts DigiD operator to European firms, citing US legal reach

The Dutch government will require any future operator of DigiD, the national digital identity platform, to be a European company. State Secretary Eric van der Burg told parliament that the post-August 2028 contract will be tendered under the Defense and Security Procurement Act, a framework that permits narrower bidder pools than standard EU procurement when national security is at stake.

The shift follows last week’s cabinet block on Kyndryl’s attempted acquisition of Solvinity, the British-owned firm that currently manages part of DigiD. Officials worried that U.S. legislation could compel an American owner to hand over citizen data or, in a worst case, disrupt access to the identity system. Kyndryl said it would resist such pressure but could not rule it out.

Van der Burg also confirmed that data handled by DigiD and the MijnOverheid citizen portal will receive stronger encryption, following recommendations from a confidential review tied to the blocked Kyndryl deal. The combined moves treat extraterritorial U.S. data laws as a structural risk to sovereign identity infrastructure rather than a contractual one.