17/10/2025
5 tips to help municipalities keep control of their data
The digital transformation within municipalities is in full swing. Citizens expect digital services that are as fast and accessible as in the private sector. At the same time, municipalities process sensitive personal data, manage critical infrastructure, and are responsible for information security, privacy, and compliance with laws and regulations.
The cloud plays a key role in this. But not every cloud solution is suitable for the public tasks of municipalities. Maintaining control over your data is essential. This means knowing not only where your information is stored, but also which laws govern it, who has access to it, and how to mitigate the risks of loss, misuse, or dependency.
This article gives you five tips for developing a cloud strategy that is not only technically sound, but also administratively defensible and legally sound.
1. Know the difference between data residency and data access
If your data is physically located in the Netherlands or Europe, you're safe. It's a common assumption, but in practice, location says little about legal authority over that data.
When using cloud providers that are not subject to European legislation, such as the American Cloud Act, there's a risk that foreign authorities could demand access to your municipal data, even if that data is stored in a Dutch data center.
In the report Too late to act? van Clingendael warns of the legal dependence on non-European cloud providers. This means governments are losing control over where their data is stored and under which jurisdiction it falls – a risk that is becoming increasingly significant amid current geopolitical tensions.
What does this mean for municipalities?
As the data controller, you are legally responsible for how data is stored and processed. You cannot outsource this responsibility to a vendor.
Therefore, choose a cloud partner that can demonstrably demonstrate that it is not a legal entity of a country with extraterritorial claims (such as the US or China), and ensure that this is also contractually stipulated in a DPA and associated processing agreement.
2. Put data sovereignty at the heart of your procurement strategy
Most tenders use technical and financial criteria as starting points, but data sovereignty is either neglected or considered an abstract concept. Sovereignty should be a strategic assessment criterion.
How then?
Include in your program of requirements:
that data must be stored and processed within the Netherlands or the EU;
that the supplier operates exclusively under Dutch and/or EU legislation;
that all management tasks (administration, support, logging) take place within EU jurisdiction;
that data portability is guaranteed, including an exit strategy without vendor lock-in.
Formulate data sovereignty as a hard, no-knock requirement and substantiate it legally. Involve your procurement lawyer, DPO, and CISO early in the process.
3. Evaluate cloud partners on their transparency, not on brand name
The public sector has long been accustomed to relying on large, established vendors. But in the cloud and data domain, visibility and control are more important than scale.
What should you pay attention to?
Can you see where your data is located and who has access to it (including logging)?
Is the architecture open or proprietary?
Is there a clear data portability arrangement?
Are management tasks performed by contracted specialists or anonymous entities?
A cloud partner who dodges these questions or dismisses them with "our security is best-in-class" doesn't fully understand the public context. Therefore, don't judge cloud providers by their branding or market share, but by their ability to offer openness, collaborate, and respect the public values of transparency, autonomy, and accountability.
4. Ensure your cloud strategy is in line with legislation such as NIS2 and the BIO
The NIS2 may have been postponed, but in the short term, municipalities will likely be required to comply with the NIS2 directive, which requires the European Union to impose stricter information security, incident reporting and risk management on critical and important entities.
In combination with existing frameworks such as the Baseline Information Security for Government (BIO), this means that municipalities must structurally recalibrate their cloud strategy:
Is the cloud supplier chain demonstrably secure?
Is 24/7 monitoring, logging and incident response guaranteed?
Are his permissions and access to data fully auditable?
Many generic cloud solutions offer insufficient guarantees on these points and are also legally difficult to audit. Have your cloud architecture assessed against NIS2/BIO requirements, including logging, escalation procedures, chain of custody, and compliance.
5. Collaborate with partners who understand public values
Digital autonomy isn't an IT project, but a strategic choice. The right cloud partner understands this and is able to offer technical solutions that align with public goals, such as reliability, accessibility, transparency, and control. Choosing a partner who shares these values allows you to collaborate on solutions that combine security, innovation, and administrative legitimacy.
How can you recognize such a partner?
The partner is transparent about data flows, ownership and access.
The partner is willing to contribute ideas on governance, policy and policy assessment.
The partner offers tailor-made solutions rather than a one-size-fits-all solution.
The partner preferably works from Dutch or European infrastructure and partnerships.
Assess suppliers based on their ability to adapt to public ambitions. This means not only considering technological specifications, but also their vision of responsibility, sustainability, and control.
Finally, if you want control, you have to start by making conscious choices
The luxury of free cloud use is over. When it comes to digital responsibility, municipalities are increasingly in the spotlight. Citizens expect transparency, regulators demand compliance. And technology is developing faster than ever.
Controlling data isn't an IT issue, but a management task. It's about knowing where your information is located, understanding who has access to it, and being able to explain why you make certain choices. A sovereign cloud strategy provides the foundation for this. It's a prerequisite for maintaining security, autonomy, and accountability in the digital domain.
Want to know more?
In our whitepaper, we demonstrate how a sovereign cloud enables organizations to effectively manage data security and comply with complex regulations.
Download the white paper and discover how your municipality can shape digital autonomy.
