Netherlands government tightens cloud rules and mandates exit plans

The Dutch cabinet has revised the Rijkscloud policy to strengthen digital sovereignty of the national administration. All Rijksorganisaties, except the defence ministry and the high courts, must assess geopolitical risks when using public cloud services and are urged to favor European or Dutch providers. The new rules discourage use of providers subject to non‑EU/EER law for core tasks and completely ban public‑cloud solutions for e‑mail, document management and base‑registrations such as the personal and land‑registry data.

Agencies are required to draft a detailed cloud strategy and an exit plan that covers both scheduled and sudden service interruptions, ensuring continuity of critical services. A four‑year transition period is granted for existing services to comply, with possible extensions in complex cases. Staatssecretaris Willemijn Aerdts emphasized that the measures aim to reduce reliance on a single supplier and to keep government data secure and available in difficult situations.