Dutch tax office picks its own servers over Microsoft 365 in the cloud
The Dutch tax office, customs and benefits agency are not moving to Microsoft 365. Their office software will run on servers they control themselves.
What happened
The Dutch tax office (Belastingdienst), customs and the benefits agency are not moving to Microsoft 365 in the cloud. Their email, calendars and documents will sit on servers they control themselves, running Microsoft software and European open source.
The state secretary for finance, Eelco Eerenberg, told parliament so on 5 October, answering questions from Inge van Dijk, an MP for the Christian Democrats (CDA). The software will run on servers the tax office runs or controls itself. Eerenberg writes that this has become possible partly because the tax office has made room in its data centres. Wherever it can, the agency will use licences it already holds.
Email and calendars move to the agency’s own servers first, in 2027. Later in 2027 and in 2028, European open-source tools follow for personal storage and collaboration. That follows the government IT review board’s advice not to buy everything from one supplier, but to look for alternatives function by function. The choice comes at a price: the replacement takes longer, and some of the planned records-management features came with the Microsoft 365 package and do not exist for in-house servers. The tax office is still working out how to solve that.
In a debate with parliament’s finance committee on 7 October, Eerenberg said it will still be Microsoft software, only on the agency’s own servers. Asked whether that puts the US CLOUD Act out of the picture, he replied that the tax office controls these systems itself, although the legal reality may differ. He also admitted that risks remain: the operating system of the servers in Apeldoorn, for example, may come from a US vendor. There is no single switch for that, he said; it has to go step by step.
“It will still be Microsoft, but on-premises.”
State Secretary Eerenberg in the committee debate of 7 October 2026, via Security.NL, translated and shortened
The background
How the only option became a pause
The programme to bring in Microsoft 365 started in 2021, for some 47,000 staff. In 2025 the government still chose it, because at the time it was, in Eerenberg’s words, the only feasible and realistic option. In February 2026 State Secretary Heijnen wrote that the move was going ahead. He rated the risk of Microsoft pulling out under political pressure as small, and the core tax work (assessment, collection and investigation) stayed in-house anyway.
On 29 June the IT review board, which scrutinises large government IT projects, delivered its advice. It was blunt: stop using Microsoft 365 in the public cloud at once and move back the staff who had already switched. In the board’s view, security fell seriously short and the dependence on a single US supplier was unacceptable. The tax investigation service FIOD could not use the package at all. In July Eerenberg paused the move to look into in-house servers first.
Why it matters where your data sits
Behind the debate lies the CLOUD Act, a US law from 2018. It lets US authorities demand data from US companies, even when that data is stored in Europe. In June 2025 Microsoft France admitted under oath before the French Senate that it cannot guarantee that French citizens’ data will never reach the US government without France’s consent, although Microsoft said it had never happened.
Closer to home, the chief prosecutor of the International Criminal Court in The Hague lost access to his Microsoft email in May 2025, after US sanctions, the AP news agency reported. Microsoft says it never stopped its services to the court, but does not explain how that account came to be cut off.
Microsoft stays a subscription in-house too
Since July 2025 Microsoft has sold its mail server for in-house servers as a subscription: Exchange Server Subscription Edition. The old 2016 and 2019 versions have received no updates since 14 October 2025. The letter to parliament names no product, but this is what Microsoft on your own servers looks like now: the data stays at home, the software remains a subscription.
Our analysis
Own servers bring the data home, not the independence
The decision really does solve one thing. Email and documents will no longer sit with Microsoft, so a CLOUD Act request to Microsoft has little left to demand, and nobody outside the tax office can shut down an account the way it happened at the court. But the software, the licences and the updates still come from the United States, as Eerenberg himself acknowledges. That is not a weakness of the decision but a sensible order of play: first decide where the data sits, then choose function by function who supplies the software.
The coverage tends to skip the cost. Running things in-house takes people and time, and both are scarce at the tax office. The new VAT system is slipping too, because the tax office is taking over its hosting. And in February this route was still called unfeasible. What has changed since is the room in the data centres, a blunt piece of advice and political pressure.
The lesson for other organisations lies in the review board’s advice, not in the data centres. Few companies will build their own server rooms, but anyone can check, function by function, what it needs to do, where the data may sit and how to get out again. Our expectation: more public bodies will take this route, and then their suppliers will be asked where their data sits too.
What stands out
- The backups did not come back According to the board, crashed or encrypted files could not be restored outside Microsoft 365. In basic tests, the backup software already failed on empty folders.
- Waiting costs too Staff already have new laptops but often still work with outdated software. In February the tax office estimated that this costs each employee 15 to 30 minutes a day.
- The licences stay with Microsoft Microsoft email on your own servers has required an active subscription since 2025. The data stays at home, but the updates still come from Microsoft.
- Only 5% is left for renewal Of the IT capacity for change, 55% goes to updating old systems, 40% to new legislation and 5% to renewal. A switch has to fit in there too.
What it means for you
For you too, the question is which software and data you want to keep in your own hands, and what that is worth to you.
- Your own servers, not necessarily a new supplier The tax office is partly staying with Microsoft, but decides for itself where the software runs. Taking back control does not have to mean replacing everything.
- Choose part by part Email asks for something different from storage or collaboration. For each part, look at what it needs to do, where the data may sit and how you get out again.
- Expect a long road A move like this takes years and can cost you features that only exist in the cloud. So it is a choice best made early.
Where we come in · Advisory
We look at where your AI runs and where your data goes
When we work out with you where AI can take work off your hands, we also look at where that AI runs and where your data ends up. Sometimes a cloud service is fine; sometimes AI on your own server is the better fit.
Which software and data do you want to keep in your own hands?
Tell us what you are weighing up. We’ll think it through with you and always reply within one working day.
