Dutch Tax Office Abandons Microsoft Cloud Over Data Privacy Risks
The Hague, Thursday 15 October 2026
The Dutch tax authority has scrapped its Microsoft 365 transition after moving 5,000 workers, choosing local open-source software over security concerns regarding US data routing.
A Sharp Policy U-Turn on Cloud Infrastructure
This dramatic policy reversal marks a major pivot from previous initiatives aimed at building European sovereign digital infrastructure [5]. In October 2025, the Dutch Ministry of Finance informed Parliament that Microsoft 365 was the only viable option for modernising the workstation environment of the tax administration [3]. However, on 14 October 2026, the Dutch Tax and Customs Administration (Belastingdienst)—which handles customs, benefits, and national revenue data—officially scrapped its public cloud rollout in favour of internal servers and open-source tools [1][3].
Security Vulnerabilities and Strategic Lock-In Risks
The decision follows a formal evaluation in June 2026 by the Dutch Advisory Council on ICT Assessment (Adviescollege ICT-toetsing), which recommended halting the rollout due to critical information security and governance risks [1][3]. State Secretary for Finance Eelco Eerenberg paused the project on 9 July 2026 before confirming the cancellation in a parliamentary letter on 5 October 2026 [2][3]. Prior to the halt, approximately 5,000 of the agency’s 47,500 total employees had already been migrated to Microsoft 365 [2][3], representing 10.526 per cent of the workforce ahead of the original 31 December 2026 completion deadline [2][3].
Technical Shortfalls and Geopolitical Exposure
Technical assessments identified severe data protection risks, including the routing of confidential government documents through servers managed by US providers, reliance on basic Microsoft encryption without Double Key Encryption, and a lack of standard end-to-end encryption for Microsoft Teams calls [1][2][3]. Furthermore, system backups left encrypted attachments unrecoverable outside the Microsoft ecosystem [2]. Beyond technical vulnerabilities, official reviews cited structural risks such as opaque metadata management, vendor lock-in, unquantified total costs, and the absence of a viable exit strategy [1][2].
Project DAWO and the Open-Source Roadmap
To replace the public cloud environment, the Belastingdienst, along with Dutch customs and benefit services, has launched Project DAWO (Digitaal Autonome Werkomgeving Overheid) [2]. Core tax processing databases will remain permanently hosted in the state’s dedicated data centre in Apeldoorn [2]. Under the timeline set out by Eerenberg, email and calendar applications will move to local, on-premises infrastructure in 2027 [1][2][3]. European open-source tools for personal file storage and workplace collaboration will follow in late 2027 and throughout 2028 [1][2][3].
Aligning with Broader European Digital Sovereignty Trends
The technical architecture under Project DAWO incorporates the NixOS operating system, Nextcloud for file storage, Collabora for document editing, Element for messaging, and OpenProject [2]. The initiative aligns with software sovereignty efforts across Germany, France, Switzerland, Austria, and Ireland [2], cooperating directly with French programmes such as ‘La Suite’ and German platforms like ‘openDesk’ [2]. The move reflects broader institutional sentiment across the continent: according to the Linux Foundation’s 2026 State of Open Source in Europe report, 94 per cent of European Union organisations consider digital sovereignty important, with 61 per cent classifying it as critical to their operational resilience [1][2][3].