Skip to main content
Regulation

Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

5 min read

When must school boards meet the Normenkader IBP?

In 2030, with a checkpoint on 1 January 2027. The Normenkader IBP (Normenkader Informatiebeveiliging en Privacy) is the Dutch framework of 69 information security norms and 25 privacy norms for primary, secondary and special education. By 1 January 2027 every school board must know where it stands against the framework, through a self-evaluation, and have a plan for meeting every norm. In 2030 boards must actually meet the norms at maturity level 3. The State Secretary for Education set both dates in a letter to the Tweede Kamer of 5 November 2025, Kamerstuk 29 240, nr. 177.

The Normenkader is not an act. It has no Staatsblad publication and no BWBR number, and as at 14 October 2026 we found no bill that makes it binding or gives the Inspectie van het Onderwijs the power to enforce it. Two duties around it are binding today. Since reporting year 2024, boards have had to report in their annual report on what they do about information security and privacy. And the GDPR applies to every school, whatever its score.

This page covers the dates, the scope and who checks what. See the other regulations we track.

Checked against the Kamerbrieven of 5 November 2025 and 2 April 2026 and the Kennisnet framework pages as at 14 October 2026.

At a glance

Full name

Normenkader Informatiebeveiliging en Privacy voor het funderend onderwijs (IBP FO)

Status

Policy framework agreed with the sector. No Staatsblad publication, no BWBR number

Developed by

Ministry of OCW, PO-Raad, VO-raad, SIVON and Kennisnet (Kennisnet)

Norms

69 for information security, 25 for privacy: 94 in total

Target

Maturity level 3 on every norm, on a scale of 1 to 5

Text last changed

6 June 2024 (Kennisnet)

Applies to

School boards in primary, secondary and special education

Self-evaluation and plan

1 January 2027

Full compliance

2030

Annual report

Section on information security and privacy, every year since reporting year 2024

Supervision

Inspectie van het Onderwijs, stimulating role only, as at 14 October 2026. GDPR: Autoriteit Persoonsgegevens

Policy basis

Kamerstuk 29 240, nr. 177, 5 November 2025

What changed in November 2025?

Before the letter, the plan was level 3 from 2027. The VO-raad called that unrealistic on 2 April 2025, pointing to the staff and money it takes. The letter kept 2027 as the year a board must know its position and moved full compliance to 2030.

ItemBeforeSince 5 November 2025

Level 3 on all norms

From 2027, as the VO-raad reported the plan on 2 April 2025

2030

What 2027 asks for

Level 3

A self-evaluation and a plan

Digitaal Veilig Onderwijs programme

Started in 2023

Extended through 2029, with €7.2 million a year for 2027 to 2029

Which schools does it cover?

The Normenkader IBP covers funderend onderwijs: primary schools, secondary schools and special education. The duty sits with the school board (bevoegd gezag), not with each school. The self-evaluation and the plan are the board's, and so is the account in the annual report.

Size changes the gap, not the duty. In the IBP in beeld survey, boards with more than 10,000 pupils averaged 2.0 out of 5 and boards with fewer than 1,000 averaged 1.5. The survey drew on 485 boards, which the programme puts at about 40% of the sector.

Mbo colleges, universities of applied sciences and universities fall outside this framework. On 2 April 2025 the VO-raad reported that mbo and higher education were discussing a similar standard from 2029/2030. As at 14 October 2026 we have not checked whether that was agreed.

What does it require?

The 2027 checkpoint asks for two documents. The 2030 deadline asks for the norms themselves.

  • By 1 January 2027

    A self-evaluation

    A baseline measurement (nulmeting) of every norm. Boards can do it themselves, with an external adviser, in GRC tooling, or with the free Zelfevaluatie Normenkader IBP tool (VO-raad, 4 March 2026).

  • By 1 January 2027

    A plan to reach level 3

    How the board will meet every norm. The Inspectie van het Onderwijs may use this plan to open a conversation with the board about digital safety.

  • 69 norms

    Information security

    Built on the model of the NBA, the Dutch professional body of accountants (Kennisnet). System development and business continuity management score lowest in the sector, both at 1.3.

  • 25 norms

    Privacy

    Taken from the SURFaudit Toetsingskader Privacy, which derives from the IBD and VNG assurance product for the GDPR (Borgingsproduct AVG). Privacy averaged 1.9 in the 2026 survey, against 1.5 for information security.

  • 2030

    Level 3 on all 94 norms

    Each norm describes five maturity levels. At level 3, measures are documented and applied consistently. The State Secretary's letter says that substantially lowers the likelihood and impact of incidents.

  • Since reporting year 2024

    An account in the annual report

    Each board writes in its annual report what it does about information security and privacy. Kennisnet's Groeipad splits the route to level 3 into five phases and 40 subprojects.

The dates

Every date below comes from the Ministry of OCW or the programme it funds. None is set by law. The 1 January 2027 date is from the Rijksoverheid page on safe ICT in education; the letter itself says "in 2027".

2023

  1. 2023 · Set by OCW

    Digitaal Veilig Onderwijs programme starts. It drafts the Normenkader IBP and sets up School-CERT

2024

  1. Reporting year 2024 onwards · Recurring

    Annual report covers information security and privacy, every year

  2. 6 June 2024 · Set by Kennisnet

    Last change to the norms. The framework text has stood unchanged since

2025

  1. 5 November 2025 · Set by OCW

    Kamerbrief 29 240, nr. 177 sets the 2027 and 2030 dates and extends the programme through 2029

2026

  1. 2 April 2026 · Set by OCW

    IBP in beeld sent to the Tweede Kamer (32 034, nr. 73): sector average 1.7 out of 5

2027

  1. 1 January 2027 · Set by OCW

    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms

2029

  1. End of 2029 · Set by OCW

    Digitaal Veilig Onderwijs programme funding ends: €7.2 million a year for 2027 to 2029

2030

  1. 2030 · Set by OCW

    School boards meet all 94 norms at maturity level 3. The letter gives the year only; the sector councils plan for the end of 2029

Without an official date

  1. No date · Under exploration by OCW (5 November 2025)

    A legal power for the Inspectie van het Onderwijs to intervene on digital safety

Who checks what?

SubjectWhoBasis

Progress against the Normenkader

Inspectie van het Onderwijs, in its stimulating role. It can discuss the 2027 plan with the board

Kamerbrief, 5 November 2025

Intervening when a board falls behind

Nobody yet. OCW is exploring a legal power for the Inspectie, as at 14 October 2026

Kamerbrief, 5 November 2025

Processing of pupil and staff data

Autoriteit Persoonsgegevens

GDPR (AVG)

Digital safety on the board's agenda

The board's internal supervisor (intern toezicht)

IBP in beeld, March 2026

What has changed?

The entries run newest first, as at 14 October 2026.

24 August 2026: the dates stand for the new school year. The VO-raad's overview of 2026/27 repeats 1 January 2027 for the self-evaluation and plan and 2030 for full compliance.

2 April 2026: IBP in beeld reaches the Tweede Kamer. State Secretary Tielen sent the programme's survey of 485 boards with letter 32 034, nr. 73. The same letter says the programme was extended "tot 2030", where the November 2025 letter said through 2029.

4 March 2026: sector guidance for 2026. The PO-Raad, VO-raad and Kennisnet told boards without a self-evaluation to do one in 2026, and to plan for level 3 by the end of 2029.

5 November 2025: the dates are set. State Secretary Becking's letter fixed 2027 for the position and plan and 2030 for the norms. It extended the programme by three years at €7.2 million a year, put €22.2 million in total into SIVON and Kennisnet's Veilig Internet service with a subsidy to mid-2030, and said OCW would explore a legal power for the Inspectie.

2 April 2025: the VO-raad rejects level 3 from 2027. It asked for better support first and for boards to tackle their highest risks before working towards level 3.

28 January 2025: the annual report duty. The VO-raad told boards that their report over 2024 must give explicit attention to information security and privacy.

What can GenCompl.ai do for you?

The dates on this page come from ministerial letters and sector guidance, not from the Staatsblad, so they can move without a gazette notice. GenCompl.ai follows the sources behind them, from the Kamerbrieven to the Kennisnet framework pages and the GDPR, and records each date with its source and how certain it is.

Book a working session

Questions and answers

Is the Normenkader IBP a legal obligation?

No, not as at 14 October 2026. The Normenkader IBP is a framework agreed between the Ministry of OCW, the PO-Raad, the VO-raad, SIVON and Kennisnet, and its deadlines come from the State Secretary's letter to the Tweede Kamer of 5 November 2025. The binding duties around it are the GDPR and, since reporting year 2024, the duty to report on information security and privacy in the annual report. OCW is exploring a legal power for the Inspectie van het Onderwijs to intervene, and we found no bill.

What must a school board have done by 1 January 2027?

Two things: a self-evaluation of where it stands against the 94 norms of the Normenkader IBP, and a plan for how it will meet all of them. The date is on the Rijksoverheid page on safe ICT in education; the State Secretary's letter of 5 November 2025 says "in 2027". A board without a baseline measurement can use the free Zelfevaluatie Normenkader IBP tool, an external adviser or GRC tooling.

What does maturity level 3 mean in the Normenkader IBP?

Each of the 94 norms in the Normenkader IBP is described at five maturity levels, and level 3 is the target. At level 3 a board's measures are documented and applied consistently. School boards must reach it on every norm in 2030.

Is the Normenkader IBP deadline the end of 2029 or 2030?

The State Secretary's letter of 5 November 2025 says school boards must meet the norms "in 2030". The PO-Raad, VO-raad and Kennisnet guidance of 4 March 2026 tells boards to plan for level 3 by the end of 2029, and the VO-raad reads the letter as 1 January 2030 at the latest. Planning for 31 December 2029 satisfies both readings.

Does the Normenkader IBP apply to mbo colleges or universities?

No. The Normenkader IBP covers primary, secondary and special education (funderend onderwijs). On 2 April 2025 the VO-raad reported that mbo and higher education were discussing a similar standard from 2029/2030. As at 14 October 2026 we have not checked whether that was agreed.

Can the Inspectie sanction a school board that misses level 3?

As at 14 October 2026, not on the basis of the Normenkader IBP alone. The Inspectie van het Onderwijs can raise digital safety with a board in its stimulating role, for example based on the board's 2027 plan. The State Secretary wants the Inspectie to be able to intervene eventually and is exploring how to set that power in law. How a specific failure might be treated under existing education or data protection law is a question for counsel.

Does meeting the Normenkader IBP make a school GDPR compliant?

Not on its own. The 25 privacy norms of the Normenkader IBP derive from the SURFaudit Toetsingskader Privacy, which in turn derives from a GDPR assurance product of the IBD and VNG. The GDPR still applies directly to every school board, and the Autoriteit Persoonsgegevens enforces it whatever a board's maturity score. Whether a given practice complies is a question for the board's data protection officer or counsel.

How far are Dutch school boards from Normenkader IBP level 3?

Far. Self-evaluations from 485 boards, about 40% of the sector, averaged 1.7 out of 5 in the IBP in beeld survey published in March 2026: 1.5 for information security and 1.9 for privacy. No board averaged level 3 on information security. The scores are self-assessed and describe how measures are designed, not whether they work.