The Netherlands proposes a law widening intelligence service powers

The Dutch government presented a proposal for a new law governing the country's intelligence services on 28 August 2026, according to NL Times and Volkskrant. The proposal gives the civilian service AIVD and the military service MIVD greater freedom of action by removing several of today's restrictions and requirements. Its orientation is surveillance and offensive operations against foreign adversaries, and the proposal is also meant to make it considerably easier for the services to cooperate with other agencies and with private companies. A clause on a state of emergency has drawn the most criticism, under which the services would be less subject to oversight. The proposal does not describe what could trigger such a state, and critics fear the clause could be used against Dutch citizens.

In a law of this kind, the mechanism lies in who has to approve what, and when. The current Dutch arrangement rests on requirements to be met before a measure is carried out, and on an independent body checking that they were. When requirements are removed, the judgement moves from a body outside the service to the service itself, and that is the part the criticism is aimed at. The state of emergency clause differs from the rest by being open ended, since a legal basis with no described triggering condition is hard to review. This account rests on the reporting in NL Times and Volkskrant, not on the text of the bill itself.

What this means for you if you hold data in the Netherlands

For you this is first of all a question of where the data sits and who can ask for it. If you use managed service providers, data centres or cloud services in the Netherlands, it is worth following which obligations the provider may take on, and what latitude the provider has to say that a request has been received. That is the practical difference for a customer, namely whether cooperation happens with or without the possibility of transparency.

This is not a Dutch peculiarity either. Several European countries are moving towards broader powers and closer cooperation between authorities and private companies, justified by the threat picture. If you sit on a board, this belongs in the assessment of jurisdiction, meaning where services are bought and where data is processed, alongside the ordinary requirements of the data protection regulation. Our assessment is that the case demands no action this week, but that it belongs on the list of framework conditions you follow.

Berigo recommends

• Establish which providers and data centres you use in the Netherlands, and which data sits there.
• Raise with your providers what routines they hold for government requests, and what they may tell the customer.
• Bring jurisdiction in as a separate item when new services are procured, not only price and function.
• Have the data protection officer follow the proposal onwards, since the changes touch the basis for transfer and processing.
• Put framework conditions of this kind on the board's watch list, with somebody accountable for reporting changes.