---
title: "IBP-verantwoordelijke"
description: "The IBP-verantwoordelijke runs a school board's daily work on information security and privacy. The role differs from the board and from the FG."
canonical: "https://gencompl.ai/glossary/ibp-verantwoordelijke"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:26:06.697Z"
modified: "2026-10-14T19:17:36.710Z"
---

# IBP-verantwoordelijke

The IBP-verantwoordelijke is the person at a school board who runs the day-to-day work on information security and privacy (IBP). The Normenkader IBP prescribes no job title: depending on the type and size of the organisation, a privacy officer, ICT coordinator, information manager or security officer can hold the role.

Also known as: IBP officer, person responsible for information security and privacy

**What does an IBP-verantwoordelijke do at a school board?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › IBP-verantwoordelijke

The IBP-verantwoordelijke is the person at a school board who runs the day-to-day work on information security and privacy (IBP). The Normenkader IBP prescribes no job title: depending on the type and size of the organisation, a privacy officer, ICT coordinator, information manager or security officer can hold the role.

## Defined in / by

- [Normenkader IBP, begrippenlijst (Kennisnet)](https://normenkaderibp.kennisnet.nl/begrippenlijst/)

Last updated: 14 October 2026.

## Three roles that are easy to merge

The Normenkader IBP works with three parties that a small school board may be tempted to fold into one person. The school board itself is the bevoegd gezag and, in Kennisnet's words, carries final responsibility for everything to do with IBP. The IBP-verantwoordelijke does the practical work. Kennisnet notes that in primary education the role is usually involved in practical implementation, and lists a range of job titles that can carry it, from privacy officer and ICT coordinator to functional administrator or quality officer.

The third party is the data protection officer, the *functionaris voor gegevensbescherming*, whose role the GDPR sets. The data protection officer monitors compliance and advises; Article 38(3) of the GDPR says he or she receives no instructions on those tasks, and Article 38(6) allows other duties only where they do not cause a conflict of interests. A person who both carries out the IBP measures and monitors them is checking his or her own work.

Size shapes the answer. The [IBP in beeld survey](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) found boards with more than 10,000 pupils averaging 2.0 and boards with fewer than 1,000 pupils averaging 1.5. Small boards have the least capacity to split roles, and the most to gain from deciding explicitly who does what.

> **What we could not establish**
>
> The definition above is our own wording. Kennisnet publishes the Normenkader IBP and its begrippenlijst, and its terms allow its texts to be reused only for non-commercial purposes, so we describe the term rather than quote it. Read Kennisnet's page for the framework's own text.

## Questions and answers

### Is the IBP-verantwoordelijke the same as the data protection officer?

No. The IBP-verantwoordelijke runs the school board's daily work on information security and privacy. The data protection officer, a role set by Articles 37 to 39 of the GDPR, monitors compliance and advises, and must not take on tasks that create a conflict of interests.

### Who carries final responsibility for IBP at a school?

The school board. Kennisnet describes the board as the bevoegd gezag that carries final responsibility for everything to do with information security and privacy, whoever carries out the work.

## Sources

- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)
- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)
- [IBP in beeld: a survey of maturity against the Normenkader IBP](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) (Programma Digitaal Veilig Onderwijs, via Eerste Kamer · 2 April 2026)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.