The DigiD takeover by a U.S. company has become one of the most important digital policy debates in the Netherlands in 2026. DigiD is the digital identity system that allows Dutch citizens to access government services, from filing taxes to healthcare and pension portals. Now that a U.S. tech firm is seeking to acquire the company behind DigiD’s infrastructure, questions about critical infrastructure, legal control, and national sovereignty have moved from theory to urgent political reality.
This debate reflects a broader cloud sovereignty debate, where governments weigh digital convenience against strategic risk. With the DigiD Takeover at the center, the outcome will affect not just DigiD users, but all organisations depending on secure, sovereign digital infrastructure.
What the DigiD Takeover Actually Entails
At the centre of the controversy is the intended acquisition of Solvinity, a Dutch cloud and infrastructure provider, by the U.S. IT services giant Kyndryl. Solvinity operates the cloud platform that underpins DigiD and other government systems, meaning the DigiD Takeover would have a broad impact on critical services.
- Solvinity provides secure cloud services to the Dutch government, including DigiD and portals like MijnOverheid and systems supporting justice services, so the DigiD Takeover puts these public digital services at the center of attention.
- Kyndryl’s planned purchase would place part of this critical infrastructure under American ownership.
Parliamentarians and digital rights experts argue that this deal goes beyond a standard business transaction. With the DigiD Takeover, it touches on core questions of who controls the digital infrastructure the Netherlands relies on.
National Security Concerns and the Role of Investment Screening BTI
One of the central mechanisms in this debate is the investment screening BTI (Bureau Toetsing Investeringen), the Dutch body responsible for reviewing foreign investments that could threaten national security. The DigiD Takeover is under particular scrutiny by these authorities.
DigiD is legally classified as critical digital infrastructure because it authenticates citizens and businesses for access to public services. Losing operational control over it raises real national security concerns, especially in light of the proposed DigiD Takeover:
- U.S. authorities could, in theory, claim access to data under laws like the Cloud Act if services fall under American legal jurisdiction as a result of the DigiD Takeover.
- The BTI review is ongoing, and its findings could determine whether the DigiD takeover is allowed to proceed.
Experts and civil liberties groups have demanded transparency from the Dutch government about this review and have even threatened legal action if the process remains opaque. They say the DigiD Takeover should receive the highest level of oversight.
Why Dutch Lawmakers Are Skeptical
Parliamentarians from across political lines in the Tweede Kamer have expressed concern over the Dutch cloud dependency on foreign tech providers. Many fear that outsourcing such a central public service could weaken the Netherlands’ ability to guarantee uninterrupted access to essential systems, especially after the debated DigiD Takeover.
Barbara Kathmann (GroenLinks–PvdA) has warned that there must be every possible effort to prevent DigiD data from ending up under foreign influence. Some lawmakers stress that without strong legal safeguards, the Dutch government could be vulnerable to geopolitical leverage. The DigiD Takeover only heightens these concerns.
This debate is not simply against global tech investment – it is about ensuring that systems fundamental to society remain under democratic control. Discussions around the DigiD Takeover have amplified the urgency of this issue.
The Rising Dutch Cloud Dependency
Concerns about DigiD are part of a wider realisation: the Netherlands is deeply dependent on foreign cloud providers. Research cited by Dutch media showed that 67 % of government, healthcare, education and critical business domains are connected to American cloud services, an issue highlighted by the DigiD Takeover debate.
This dependency impacts more than identity systems: it reaches into data storage, communications, and digital services at every level. Critics argue that this reliance gives foreign governments indirect influence over Dutch operations and data flows, especially in a world of growing strategic competition. The DigiD Takeover has become a symbol of this shift.
Alternatives and the Push for Sovereign Cloud Infrastructure
Dutch tech companies and MPs have pointed out that there are alternatives to U.S. tech dominance. At hearings in the Tweede Kamer, tech providers said that Dutch cloud services can already deliver about 80 % of what American providers offer – including storage, software, and government systems.
Some experts argue that a mix of local and European providers, paired with public policy backing, could reduce foreign exposure and strengthen digital sovereignty. This reflects a broader push for cloud sovereignty – where governments retain legal and operational control over core digital infrastructure.
However, structural hurdles remain. Existing procurement rules and ecosystem lock-in mean that Dutch and European alternatives often struggle to compete on convenience and cost. Changes to these systems would require political will and strategic investment.
What This Means for Dutch and European Organisations
The DigiD takeover debate is more than a national political story. It highlights real risks in public and private sectors that rely on foreign cloud ecosystems. If a system as foundational as DigiD can be subject to a foreign acquisition, other critical services could face similar strategic vulnerability.
This is a reminder of the – something organisations across Europe must consider as they plan infrastructure, compliance, and risk strategies. The Netherlands is now grappling with these questions at a national level. Other countries will likely watch closely.
Where vBoxx fits in this conversation
The DigiD takeover debate shows that digital sovereignty is no longer an abstract policy issue. It has direct consequences for how organisations protect data, ensure continuity, and manage long-term risk. When critical infrastructure depends on foreign cloud providers, every organisation needs to reassess its exposure.
At vBoxx, we help organisations take practical steps toward greater control. Our secure, European-rooted cloud solutions are designed to reduce dependency on foreign jurisdiction cloud services while maintaining high standards for security, usability, and compliance. This is not about rejecting innovation, but about making informed, sovereign technology choices.
If your organisation is evaluating its cloud strategy, questioning its cloud dependency, or preparing for stricter regulatory and geopolitical pressure, our experts are here to help.
Contact us today to explore how vBoxx can help your organisation keep data secure, compliant, and truly European.
