--- title: "Schoolbestuur" description: "A schoolbestuur is the bevoegd gezag of one or more Dutch schools, and the party the Normenkader IBP holds responsible for security and privacy." canonical: "https://gencompl.ai/glossary/schoolbestuur" language: "en-US" type: "Glossary term" published: "2026-10-14T18:26:50.694Z" modified: "2026-10-14T19:17:36.731Z" --- # Schoolbestuur The schoolbestuur is the body that runs one or more Dutch schools and is their bevoegd gezag under education law. Under the Normenkader IBP it carries final responsibility for information security and privacy, does the self-evaluation and reports on IBP in its annual report. Also known as: school board, bevoegd gezag, competent authority of a school **What is a schoolbestuur, and what is its role in the Normenkader IBP?** Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp) [Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Schoolbestuur The schoolbestuur is the body that runs one or more Dutch schools and is their bevoegd gezag under education law. Under the Normenkader IBP it carries final responsibility for information security and privacy, does the self-evaluation and reports on IBP in its annual report. ## Defined in / by - [Normenkader IBP, begrippenlijst (Kennisnet)](https://normenkaderibp.kennisnet.nl/begrippenlijst/) Last updated: 14 October 2026. ## Schoolbestuur in practice, bevoegd gezag in law Schoolbestuur is the everyday word. Education law uses *bevoegd gezag*, and defines it by type of school. [Article 1 of the Wet op het primair onderwijs](https://wetten.overheid.nl/BWBR0003420/2026-08-01) names, for a public school, the municipal executive (unless the council decides otherwise), the body competent under a joint arrangement, the public legal person of Article 47 or the foundation of Article 17 or 48; for a special school, the legal person of Article 55; and for a cooperation school, the foundation of Article 17d. [Article 1.1 of the Wet voortgezet onderwijs 2020](https://wetten.overheid.nl/BWBR0044212/2026-08-01) has its own definition for secondary schools along the same lines. For the Normenkader IBP the board is the unit that counts. The State Secretary's letter of 5 November 2025 speaks of "ieder schoolbestuur": each board must know its position in 2027 and meet the norms in 2030, and since reporting year 2024 each board has had to report on information security and privacy in its annual report. One board can run a single school or dozens, and the [IBP in beeld survey](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) reported results by board size: boards with more than 10,000 pupils averaged 2.0 out of 5, those with fewer than 1,000 averaged 1.5. Under the GDPR the board will usually be the controller for the school's own pupil and staff records, because it decides why and how they are processed. Whether it is controller for a given processing remains a question of fact, especially where it works with a samenwerkingsverband or a supplier. > **What we could not establish** > > The definition above is our own wording. Kennisnet's begrippenlijst describes the schoolbestuur in one sentence, and its texts may be reused only for non-commercial purposes. The statutory term is bevoegd gezag; the articles cited above give its text for primary and secondary education. Special education has its own act, which we have not checked for this entry. ## Questions and answers ### Is a schoolbestuur the same as the bevoegd gezag? In practice, yes. Schoolbestuur is the everyday word for the body that runs one or more schools. Dutch education law calls it the bevoegd gezag and defines it per type of school, in Article 1 of the Wet op het primair onderwijs and Article 1.1 of the Wet voortgezet onderwijs 2020. ### What must a schoolbestuur do under the Normenkader IBP? Do a self-evaluation and have a plan to meet all norms by 1 January 2027, meet all norms at maturity level 3 in 2030, and report on information security and privacy in its annual report, which has been required since reporting year 2024. ## Sources - [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet) - [Wet op het primair onderwijs (BWBR0003420)](https://wetten.overheid.nl/BWBR0003420/2026-08-01) (wetten.overheid.nl · 1 August 2026) - [Wet voortgezet onderwijs 2020 (BWBR0044212)](https://wetten.overheid.nl/BWBR0044212/2026-08-01) (wetten.overheid.nl · 1 August 2026) - [Kamerbrief Digitale veiligheid in het funderend onderwijs (29 240, nr. 177)](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691) (Tweede Kamer · 5 November 2025) - [IBP in beeld: a survey of maturity against the Normenkader IBP](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) (Programma Digitaal Veilig Onderwijs, via Eerste Kamer · 2 April 2026) ## Related content ### Regulation - [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.