Cloud Security The Hague Centre — multi-cloud

Data residency

No general statutory localisation requirement beyond GDPR/EEA transfer rules. Central-government buyers apply the rijksbreed cloudbeleid, which requires a data protection impact assessment before public-cloud use and restricts state secrets and special-category personal data in foreign-provider public cloud; that policy has been under revision following critical reporting by the Algemene Rekenkamer and the Autoriteit Persoonsgegevens.

What shapes cloud procurement here

The Netherlands is one of Europe's densest interconnection markets — AMS-IX and the Amsterdam colocation cluster mean latency and peering are rarely the differentiator, while power and zoning constraints around Amsterdam have pushed newer capacity toward Groningen and other regions. Regulatory timing is live: the Cyberbeveiligingswet transposing NIS2 enters into force on 15 August 2026, with the RDI supervising cloud, data centre and managed service providers and registration becoming mandatory rather than voluntary. Government and semi-public buyers work under the rijksbreed cloudbeleid, so DPIA evidence, subprocessor transparency and concentration-risk/exit arguments show up early in evaluation. English is widely accepted for technical and architectural documentation, but formal tenders are published and answered in Dutch via TenderNed.

Sector regulators