Skip to main content
Glossary termPublished inNormenkader IBP

Schoolbestuur

Also known as school board, bevoegd gezag, competent authority of a school

What is a schoolbestuur, and what is its role in the Normenkader IBP?

The schoolbestuur is the body that runs one or more Dutch schools and is their bevoegd gezag under education law. Under the Normenkader IBP it carries final responsibility for information security and privacy, does the self-evaluation and reports on IBP in its annual report.

Defined in / by

Last updated: 14 October 2026.

Schoolbestuur in practice, bevoegd gezag in law

Schoolbestuur is the everyday word. Education law uses bevoegd gezag, and defines it by type of school. Article 1 of the Wet op het primair onderwijs names, for a public school, the municipal executive (unless the council decides otherwise), the body competent under a joint arrangement, the public legal person of Article 47 or the foundation of Article 17 or 48; for a special school, the legal person of Article 55; and for a cooperation school, the foundation of Article 17d. Article 1.1 of the Wet voortgezet onderwijs 2020 has its own definition for secondary schools along the same lines.

For the Normenkader IBP the board is the unit that counts. The State Secretary's letter of 5 November 2025 speaks of "ieder schoolbestuur": each board must know its position in 2027 and meet the norms in 2030, and since reporting year 2024 each board has had to report on information security and privacy in its annual report. One board can run a single school or dozens, and the IBP in beeld survey reported results by board size: boards with more than 10,000 pupils averaged 2.0 out of 5, those with fewer than 1,000 averaged 1.5.

Under the GDPR the board will usually be the controller for the school's own pupil and staff records, because it decides why and how they are processed. Whether it is controller for a given processing remains a question of fact, especially where it works with a samenwerkingsverband or a supplier.

Questions and answers

Is a schoolbestuur the same as the bevoegd gezag?

In practice, yes. Schoolbestuur is the everyday word for the body that runs one or more schools. Dutch education law calls it the bevoegd gezag and defines it per type of school, in Article 1 of the Wet op het primair onderwijs and Article 1.1 of the Wet voortgezet onderwijs 2020.

What must a schoolbestuur do under the Normenkader IBP?

Do a self-evaluation and have a plan to meet all norms by 1 January 2027, meet all norms at maturity level 3 in 2030, and report on information security and privacy in its annual report, which has been required since reporting year 2024.

Sources

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms