---
title: "Kroonjuwelen"
description: "Kroonjuwelen: the data whose theft or loss would hurt a school most, such as pupil, staff and financial data. Where Normenkader IBP work starts."
canonical: "https://gencompl.ai/glossary/kroonjuwelen-normenkader-ibp"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:26:36.150Z"
modified: "2026-10-14T19:05:30.704Z"
---

# Kroonjuwelen

Kroonjuwelen are the data whose theft, destruction or loss would do a school the most harm. Kennisnet names pupil data as the obvious example and adds staff and financial data. Knowing them tells a school board where its first security effort should go.

Also known as: crown jewels, crown jewel data

**What are the "kroonjuwelen" of a school in the Normenkader IBP?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Kroonjuwelen

Kroonjuwelen are the data whose theft, destruction or loss would do a school the most harm. Kennisnet names pupil data as the obvious example and adds staff and financial data. Knowing them tells a school board where its first security effort should go.

## Defined in / by

- [Normenkader IBP, begrippenlijst (Kennisnet)](https://normenkaderibp.kennisnet.nl/begrippenlijst/)

Last updated: 14 October 2026.

## Where the risk analysis starts

The term is not a legal category. Nothing in the GDPR or in Dutch education law defines kroonjuwelen, and the Normenkader IBP does not give a fixed list. It is a working concept: before a board can decide which measures come first, it needs to know which data it can least afford to lose. The Groeipad follows the same logic: phase 2 covers the largest risks, right after the preconditions in phase 1.

Two kinds of harm sit in the concept, and they point to different measures. Theft or unauthorised disclosure of pupil data is a confidentiality problem, and under the GDPR it is a personal data breach that may have to be notified to the Autoriteit Persoonsgegevens within 72 hours. Destruction or loss, for example after a ransomware attack, is an availability problem: the school cannot run its administration or contact parents. The second kind is where the sector is weakest. The [IBP in beeld survey](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) found business continuity management among the two lowest-scoring domains, at 1.3 out of 5.

Kroonjuwelen are not only personal data. Financial records and the systems that hold the school's administration can be crown jewels because the school stops working without them. A board that lists only the GDPR-relevant data has done half the exercise.

> **What we could not establish**
>
> The definition above is our own wording. Kennisnet publishes the Normenkader IBP and its begrippenlijst, and its terms allow its texts to be reused only for non-commercial purposes, so we describe the term rather than quote it. Read Kennisnet's page for the framework's own text.

## Questions and answers

### Are kroonjuwelen a legal term in the Normenkader IBP?

No. Kroonjuwelen is a working term in Kennisnet's begrippenlijst for the Normenkader IBP, not a category defined by law. It names the data whose theft, destruction or loss would harm the school most, such as pupil, staff and financial data.

### Are kroonjuwelen always personal data?

No. Pupil and staff data are personal data, but Kennisnet also names financial data, and a school can depend on systems and records that contain no personal data at all.

## Sources

- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)
- [IBP in beeld: a survey of maturity against the Normenkader IBP](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) (Programma Digitaal Veilig Onderwijs, via Eerste Kamer · 2 April 2026)
- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.