Zuid-Holland needs 1.5 years to completely close data leak

The province of Zuid-Holland thinks it will need another year and a half to get its internal information security in order. Zuid-Holland is under increased supervision of the Dutch Data Protection Authority (AP) after an employee discovered a data leak in an internal system last September. According to the province, it is "an enormous task" and "a labor-intensive process" to close the data leak and to ensure that cyber security is at the minimum required level.

The system in question contains approximately 50 million documents. The province discovered that employees could access privacy-sensitive data that they should not have been given access to, such as personal information, salary specifications, and criminal records. Immediately after the data breach was reported, several documents and certain folders were closed. An investigation team has since been working to determine the risks of all documents.

The Christian Union had submitted written questions about the case, which became public this spring. In the answers, the province states that it aims to meet the AP requirement on 1 January 2026, namely that Zuid-Holland reaches step 3 (of 5) of the GDPR maturity level.

"AP understands that an organization may need some time to reach an adequate level. At the same time, the AP will not accept it if progress is not shown in the short term," says a spokesperson for the privacy watchdog. "If the province falls short, the AP can decide to take enforcement action at any time." This can be a reprimand, but also a fine or an order subject to penalty.

Steven Datema of the Christian Union in Zuid-Holland says he is "not at all reassured." "I understand that you can't break iron with your hands. However, waiting another year and a half before data protection is at the acceptable minimum level is very long. People must be able to trust that their personal data is safe with the province."

The official who oversees GDPR compliance had already advised in 2019 to ensure that the "roles and rights" in the outdated system are in order and to replace this system in the long term. Zuid-Holland acknowledges that much advice in this area has not been adequately followed in recent years. The province has reserved 23 million euros for an "information transition".