The Netherlands’ Tax and Customs Administration has abandoned its 2025 initiative to migrate to Microsoft 365 public-cloud services, opting instead for a hybrid solution incorporating on-premises infrastructure and European open-source software to safeguard data control and security.
- Dutch Tax Administration halts Microsoft 365 cloud rollout over security and sovereignty issues
- Shift to on-premises and open-source solutions planned through 2028
- Decision reflects broader European emphasis on digital sovereignty and vendor independence
What happened
The Netherlands’ Tax and Customs Administration canceled its planned transition to Microsoft 365’s public-cloud environment, which was set to complete by the end of 2026. About 5,000 employees had already migrated before an advisory council recommended halting the rollout due to concerns over information security and data processing practices. Instead of continuing with the cloud strategy, the administration now plans an on-premises mail and calendar system rollout in 2027, complemented by European open-source personal storage and collaboration tools through 2027 and 2028.
This decision follows a detailed ICT assessment that identified multiple issues with the proposed Microsoft 365 setup, including insufficient encryption controls, non-default end-to-end encryption for Teams communications, and reliance on American servers for confidential data transmission. The report flagged risks related to vendor lock-in, lack of flexibility, and a missing exit strategy, urging a pivot toward solutions that enhance autonomy and privacy.
Why it matters
This move is emblematic of a growing European trend prioritizing digital sovereignty—the ability of organizations and governments to control their own data and infrastructure without undue external influence. According to a recent Linux Foundation Europe report, 94% of EU organizations view digital sovereignty as important, with 61% rating it very important. The Dutch decision aligns with similar transitions in Austria, France, Germany, Ireland, and Switzerland, where public agencies adopt Linux and open-source office suites to gain greater control over their IT environments.
From a geopolitical and security perspective, reliance on US-based cloud providers is increasingly scrutinized within Europe due to concerns about data privacy under current US policies. By shifting to on-premises and open-source solutions, the Dutch government aims to mitigate risks of unauthorized data access and ensure higher transparency and control over encryption practices, which are fundamental to safeguarding sensitive public information.
What to watch next
The implementation phase will be crucial to observe as the Dutch Tax Administration moves forward with its hybrid approach. Starting in 2027, the rollout of on-premises mail and calendar services will serve as an initial test of balancing local infrastructure with legacy Microsoft software. The impact of gradually integrating European open-source personal storage and collaboration tools will reveal how effectively open-source solutions can meet the stringent demands of a critical government agency.
This development also raises broader questions about the future of cloud adoption across Europe’s public sector. Observers should monitor if the Dutch approach influences other national administrations contemplating balancing cloud benefits with digital sovereignty. Additionally, the evolution of encryption standards and exit strategies in government-wide SaaS deployments will be key indicators of whether public agencies can reduce dependency on large US cloud vendors without sacrificing security or functionality.