Dutch tax authority halts Microsoft 365 cloud rollout over security concerns
The Netherlands Tax and Customs Administration has abandoned plans to move its services to Microsoft 365’s public cloud, opting instead for systems hosted on infrastructure it controls and European open-source tools. The shift reflects concerns about information security, dependence on a single US supplier and the administration’s ability to move to more autonomous services in future.
Email and calendars are due to move on-premises in 2027, with European open-source alternatives for personal storage and collaboration following in late 2027 and 2028. The Microsoft 365 rollout had reached about 5,000 of 47,500 employees after the authority selected it in 2025; an advisory council said the cloud design fell short on security, data handling and future-proofing. More data-centre capacity made the revised plan possible, but the administration is still working out how to replace some records-management capabilities that are unavailable on-premises.
- Dutch tax services will move email and calendars in-house in 2027.
- European open-source storage and collaboration tools are planned for 2027 and 2028.
- Security, supplier dependence and records management shaped the reversal.
New here? Start with this
Microsoft 365 is a cloud service that provides email, calendars, document storage and collaboration tools. Many large employers use it, but adopting cloud services means an external company controls the servers where sensitive data is stored.
The Netherlands Tax and Customs Administration, the government body responsible for collecting taxes and managing customs, decided in 2025 to adopt Microsoft 365 for its workforce. However, security concerns emerged about storing sensitive government data with a US company, and officials worried that the arrangement would lock the department into reliance on a single vendor.
The administration has decided to use computer systems it controls directly and European open-source software instead. This approach gives the department ownership of its infrastructure and reduces dependence on any single commercial technology company.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Government tax authorities handle exceptionally sensitive personal financial data and must prioritise institutional control and data security above all else. Microsoft 365's reliance on US-based infrastructure creates legitimate sovereignty concerns under European data protection principles and exposes data to potential external requests. The advisory council's specific concerns about security and data handling, combined with the feasibility of European open-source alternatives, justify prioritising long-term autonomy and compliance over the convenience of a commercial platform.
The case against
Enterprise-scale digital infrastructure requires specialised expertise, rigorous security protocols, and continuous investment that public organisations frequently struggle to maintain adequately in-house. Microsoft 365 represents decades of security development and proven reliability serving millions of users; achieving equivalent standards through custom open-source systems demands substantial technical resources and operational burden. The tax authority's successful rollout to 5,000 employees demonstrates the platform's viability; reverting to on-premises infrastructure risks diversion of resources from core services and operational fragility during the expensive transition.
Read the full article at the source →
Originally published by The Register as “Dutch tax office ditches Microsoft 365 cloud for on-premises alternative”.