Skip to main content
Glossary termPublished inNormenkader IBP

Kroonjuwelen

Also known as crown jewels, crown jewel data

What are the "kroonjuwelen" of a school in the Normenkader IBP?

Kroonjuwelen are the data whose theft, destruction or loss would do a school the most harm. Kennisnet names pupil data as the obvious example and adds staff and financial data. Knowing them tells a school board where its first security effort should go.

Defined in / by

Last updated: 14 October 2026.

Where the risk analysis starts

The term is not a legal category. Nothing in the GDPR or in Dutch education law defines kroonjuwelen, and the Normenkader IBP does not give a fixed list. It is a working concept: before a board can decide which measures come first, it needs to know which data it can least afford to lose. The Groeipad follows the same logic: phase 2 covers the largest risks, right after the preconditions in phase 1.

Two kinds of harm sit in the concept, and they point to different measures. Theft or unauthorised disclosure of pupil data is a confidentiality problem, and under the GDPR it is a personal data breach that may have to be notified to the Autoriteit Persoonsgegevens within 72 hours. Destruction or loss, for example after a ransomware attack, is an availability problem: the school cannot run its administration or contact parents. The second kind is where the sector is weakest. The IBP in beeld survey found business continuity management among the two lowest-scoring domains, at 1.3 out of 5.

Kroonjuwelen are not only personal data. Financial records and the systems that hold the school's administration can be crown jewels because the school stops working without them. A board that lists only the GDPR-relevant data has done half the exercise.

Questions and answers

Are kroonjuwelen a legal term in the Normenkader IBP?

No. Kroonjuwelen is a working term in Kennisnet's begrippenlijst for the Normenkader IBP, not a category defined by law. It names the data whose theft, destruction or loss would harm the school most, such as pupil, staff and financial data.

Are kroonjuwelen always personal data?

No. Pupil and staff data are personal data, but Kennisnet also names financial data, and a school can depend on systems and records that contain no personal data at all.

Sources

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms