---
title: "Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)"
description: "Dutch school boards must assess themselves against the Normenkader IBP by 1 January 2027 and meet level 3 on all 94 norms in 2030. Who checks what."
canonical: "https://gencompl.ai/regulations/normenkader-ibp"
language: "en-US"
type: "Regulation"
published: "2026-10-13T22:02:27.564Z"
modified: "2026-10-13T22:05:29.162Z"
---

# Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

Also known as: Normenkader IBP FO, IBP-normenkader, Normenkader Informatiebeveiliging en Privacy funderend onderwijs, Dutch school information security and privacy framework

**When must Dutch school boards meet the Normenkader IBP, and is it a legal duty?**

[Home](https://gencompl.ai/) › [Regulations](https://gencompl.ai/regulations) › Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

## When must school boards meet the Normenkader IBP?

**In 2030, with a checkpoint on 1 January 2027.** The Normenkader IBP (*Normenkader Informatiebeveiliging en Privacy*) is the Dutch framework of 69 information security norms and 25 privacy norms for primary, secondary and special education. By 1 January 2027 every school board must know where it stands against the framework, through a self-evaluation, and have a plan for meeting every norm. In 2030 boards must actually meet the norms at maturity level 3. The State Secretary for Education set both dates in a [letter to the Tweede Kamer of 5 November 2025](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691), Kamerstuk 29 240, nr. 177.

The Normenkader is not an act. It has no Staatsblad publication and no BWBR number, and as at 14 October 2026 we found no bill that makes it binding or gives the Inspectie van het Onderwijs the power to enforce it. Two duties around it are binding today. Since reporting year 2024, boards have had to report in their annual report on what they do about information security and privacy. And the GDPR applies to every school, whatever its score.

This page covers the dates, the scope and who checks what. See [the other regulations we track](https://gencompl.ai/regulations).

Checked against the Kamerbrieven of 5 November 2025 and 2 April 2026 and the Kennisnet framework pages as at 14 October 2026.

> **Our analysis: End of 2029 or 2030?**
>
> The letter of 5 November 2025 says boards must meet the norms "in 2030". The [guidance of 4 March 2026](https://vo-raad.nl/nieuws/digitale-veiligheid-dit-vraagt-2026-van-schoolbesturen) from the PO-Raad, VO-raad and Kennisnet asks boards to plan for level 3 by the end of 2029, and the [VO-raad's summary of the letter](https://vo-raad.nl/nieuws/digitaal-veilig-onderwijs-in-2030-vraagt-nu-actie-van-schoolbesturen) reads it as 1 January 2030 at the latest. Our reading: plan for 31 December 2029. A plan that lands in mid-2030 fits the letter's wording but misses the date the sector councils work to, and as at 14 October 2026 nobody has said which reading the Inspectie will apply.

## At a glance

- **Full name**: *Normenkader Informatiebeveiliging en Privacy voor het funderend onderwijs* (IBP FO)
- **Status**: Policy framework agreed with the sector. No Staatsblad publication, no BWBR number
- **Developed by**: Ministry of OCW, PO-Raad, VO-raad, SIVON and Kennisnet ([Kennisnet](https://normenkaderibp.kennisnet.nl/))
- **Norms**: 69 for information security, 25 for privacy: 94 in total
- **Target**: Maturity level 3 on every norm, on a scale of 1 to 5
- **Text last changed**: 6 June 2024 ([Kennisnet](https://normenkaderibp.kennisnet.nl/wijzigingen/))
- **Applies to**: School boards in primary, secondary and special education
- **Self-evaluation and plan**: **1 January 2027**
- **Full compliance**: **2030**
- **Annual report**: Section on information security and privacy, every year since reporting year 2024
- **Supervision**: Inspectie van het Onderwijs, stimulating role only, as at 14 October 2026. GDPR: Autoriteit Persoonsgegevens
- **Policy basis**: [Kamerstuk 29 240, nr. 177](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691), 5 November 2025

## What changed in November 2025?

Before the letter, the plan was level 3 from 2027. The VO-raad [called that unrealistic](https://vo-raad.nl/nieuws/realistische-planning-nodig-voor-voldoen-aan-normenkader-ibp) on 2 April 2025, pointing to the staff and money it takes. The letter kept 2027 as the year a board must know its position and moved full compliance to 2030.

| Item | Before | Since 5 November 2025 |
| --- | --- | --- |
| Level 3 on all norms | From 2027, as the VO-raad reported the plan on 2 April 2025 | **2030** |
| What 2027 asks for | Level 3 | A self-evaluation and a plan |
| Digitaal Veilig Onderwijs programme | Started in 2023 | Extended through 2029, with €7.2 million a year for 2027 to 2029 |

## Which schools does it cover?

The Normenkader IBP covers *funderend onderwijs*: primary schools, secondary schools and special education. The duty sits with the school board (*bevoegd gezag*), not with each school. The self-evaluation and the plan are the board's, and so is the account in the annual report.

Size changes the gap, not the duty. In the [IBP in beeld survey](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document), boards with more than 10,000 pupils averaged 2.0 out of 5 and boards with fewer than 1,000 averaged 1.5. The survey drew on 485 boards, which the programme puts at about 40% of the sector.

Mbo colleges, universities of applied sciences and universities fall outside this framework. On 2 April 2025 the VO-raad reported that mbo and higher education were discussing a similar standard from 2029/2030. As at 14 October 2026 we have not checked whether that was agreed.

## What does it require?

The 2027 checkpoint asks for two documents. The 2030 deadline asks for the norms themselves.

*By 1 January 2027*

### A self-evaluation

A baseline measurement (*nulmeting*) of every norm. Boards can do it themselves, with an external adviser, in GRC tooling, or with the free Zelfevaluatie Normenkader IBP tool ([VO-raad, 4 March 2026](https://vo-raad.nl/nieuws/digitale-veiligheid-dit-vraagt-2026-van-schoolbesturen)).

*By 1 January 2027*

### A plan to reach level 3

How the board will meet every norm. The Inspectie van het Onderwijs may use this plan to open a conversation with the board about digital safety.

*69 norms*

### Information security

Built on the model of the NBA, the Dutch professional body of accountants ([Kennisnet](https://normenkaderibp.kennisnet.nl/totstandkoming/)). System development and business continuity management score lowest in the sector, both at 1.3.

*25 norms*

### Privacy

Taken from the SURFaudit Toetsingskader Privacy, which derives from the IBD and VNG assurance product for the GDPR (*Borgingsproduct AVG*). Privacy averaged 1.9 in the 2026 survey, against 1.5 for information security.

*2030*

### Level 3 on all 94 norms

Each norm describes five maturity levels. At level 3, measures are documented and applied consistently. The State Secretary's letter says that substantially lowers the likelihood and impact of incidents.

*Since reporting year 2024*

### An account in the annual report

Each board writes in its annual report what it does about information security and privacy. Kennisnet's Groeipad splits the route to level 3 into five phases and 40 subprojects.

> **Our analysis: How far boards are from level 3**
>
> Self-evaluations from 485 boards, collected between 24 December 2025 and 16 January 2026, put the sector at an average of 1.7 on a scale of 1 to 5: 1.5 for information security and 1.9 for privacy ([IBP in beeld, March 2026](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document)). No board averaged level 3 on information security. Our reading: a typical board has four years to climb one and a half levels across 69 security norms. The real gap is unlikely to be smaller than that, because the scores are self-assessed, were not validated externally, and describe how measures are designed rather than whether they work.

> **What we could not establish**
>
> We have not read the instrument that makes the annual report section mandatory. The State Secretary's letter of 5 November 2025 calls it a duty since reporting year 2024, and the [VO-raad, on 28 January 2025](https://vo-raad.nl/nieuws/verplicht-aandacht-voor-informatiebeveiliging-en-privacy-in-het-jaarverslag), traces it to an OCW letter on societal themes in the annual report. We found no article number to cite.

## The dates

Every date below comes from the Ministry of OCW or the programme it funds. None is set by law. The 1 January 2027 date is from the [Rijksoverheid page on safe ICT in education](https://www.rijksoverheid.nl/onderwerpen/digitalisering-onderwijs/veilige-en-goede-ict-in-het-onderwijs); the letter itself says "in 2027".

### 2023

- **2023 · Set by OCW**: Digitaal Veilig Onderwijs programme starts. It drafts the Normenkader IBP and sets up School-CERT

### 2024

- **Reporting year 2024 onwards · Recurring**: Annual report covers information security and privacy, every year
- **6 June 2024 · Set by Kennisnet**: Last change to the norms. The framework text has stood unchanged since

### 2025

- **5 November 2025 · Set by OCW**: Kamerbrief 29 240, nr. 177 sets the 2027 and 2030 dates and extends the programme through 2029

### 2026

- **2 April 2026 · Set by OCW**: IBP in beeld sent to the Tweede Kamer (32 034, nr. 73): sector average 1.7 out of 5

### 2027

- **1 January 2027 · Set by OCW**: Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms

### 2029

- **End of 2029 · Set by OCW**: Digitaal Veilig Onderwijs programme funding ends: €7.2 million a year for 2027 to 2029

### 2030

- **2030 · Set by OCW**: School boards meet all 94 norms at maturity level 3. The letter gives the year only; the sector councils plan for the end of 2029

### Without an official date

- **No date · Under exploration by OCW (5 November 2025)**: A legal power for the Inspectie van het Onderwijs to intervene on digital safety

## Who checks what?

| Subject | Who | Basis |
| --- | --- | --- |
| Progress against the Normenkader | Inspectie van het Onderwijs, in its stimulating role. It can discuss the 2027 plan with the board | [Kamerbrief, 5 November 2025](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691) |
| Intervening when a board falls behind | Nobody yet. OCW is exploring a legal power for the Inspectie, as at 14 October 2026 | [Kamerbrief, 5 November 2025](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691) |
| Processing of pupil and staff data | [Autoriteit Persoonsgegevens](https://gencompl.ai/authorities/autoriteit-persoonsgegevens) | GDPR (AVG) |
| Digital safety on the board's agenda | The board's internal supervisor (*intern toezicht*) | [IBP in beeld, March 2026](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) |

## What has changed?

The entries run newest first, as at 14 October 2026.

**24 August 2026: the dates stand for the new school year.** The [VO-raad's overview of 2026/27](https://vo-raad.nl/nieuws/wat-verandert-er-dit-schooljaar-2627) repeats 1 January 2027 for the self-evaluation and plan and 2030 for full compliance.

**2 April 2026: IBP in beeld reaches the Tweede Kamer.** State Secretary Tielen sent the programme's survey of 485 boards with [letter 32 034, nr. 73](https://zoek.officielebekendmakingen.nl/kst-32034-73.html). The same letter says the programme was extended "tot 2030", where the November 2025 letter said through 2029.

**4 March 2026: sector guidance for 2026.** The PO-Raad, VO-raad and Kennisnet [told boards](https://vo-raad.nl/nieuws/digitale-veiligheid-dit-vraagt-2026-van-schoolbesturen) without a self-evaluation to do one in 2026, and to plan for level 3 by the end of 2029.

**5 November 2025: the dates are set.** State Secretary Becking's [letter](https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/kamerstukken/2025/11/05/kamerbrief-digitale-veiligheid-funderend-onderwijs/Kamerbrief++-+Digitale+veiligheid+funderend+onderwijs+2025.pdf) fixed 2027 for the position and plan and 2030 for the norms. It extended the programme by three years at €7.2 million a year, put €22.2 million in total into SIVON and Kennisnet's Veilig Internet service with a subsidy to mid-2030, and said OCW would explore a legal power for the Inspectie.

**2 April 2025: the VO-raad rejects level 3 from 2027.** It asked for better support first and for boards to tackle their highest risks before working towards level 3.

**28 January 2025: the annual report duty.** The [VO-raad](https://vo-raad.nl/nieuws/verplicht-aandacht-voor-informatiebeveiliging-en-privacy-in-het-jaarverslag) told boards that their report over 2024 must give explicit attention to information security and privacy.

## What can GenCompl.ai do for you?

The dates on this page come from ministerial letters and sector guidance, not from the Staatsblad, so they can move without a gazette notice. GenCompl.ai follows the sources behind them, from the Kamerbrieven to the Kennisnet framework pages and the GDPR, and records each date with its source and how certain it is.

- [Book a working session](https://gencompl.ai/contact)

## Questions and answers

### Is the Normenkader IBP a legal obligation?

No, not as at 14 October 2026. The Normenkader IBP is a framework agreed between the Ministry of OCW, the PO-Raad, the VO-raad, SIVON and Kennisnet, and its deadlines come from the State Secretary's letter to the Tweede Kamer of 5 November 2025. The binding duties around it are the GDPR and, since reporting year 2024, the duty to report on information security and privacy in the annual report. OCW is exploring a legal power for the Inspectie van het Onderwijs to intervene, and we found no bill.

### What must a school board have done by 1 January 2027?

Two things: a self-evaluation of where it stands against the 94 norms of the Normenkader IBP, and a plan for how it will meet all of them. The date is on the Rijksoverheid page on safe ICT in education; the State Secretary's letter of 5 November 2025 says "in 2027". A board without a baseline measurement can use the free Zelfevaluatie Normenkader IBP tool, an external adviser or GRC tooling.

### What does maturity level 3 mean in the Normenkader IBP?

Each of the 94 norms in the Normenkader IBP is described at five maturity levels, and level 3 is the target. At level 3 a board's measures are documented and applied consistently. School boards must reach it on every norm in 2030.

### Is the Normenkader IBP deadline the end of 2029 or 2030?

The State Secretary's letter of 5 November 2025 says school boards must meet the norms "in 2030". The PO-Raad, VO-raad and Kennisnet guidance of 4 March 2026 tells boards to plan for level 3 by the end of 2029, and the VO-raad reads the letter as 1 January 2030 at the latest. Planning for 31 December 2029 satisfies both readings.

### Does the Normenkader IBP apply to mbo colleges or universities?

No. The Normenkader IBP covers primary, secondary and special education (funderend onderwijs). On 2 April 2025 the VO-raad reported that mbo and higher education were discussing a similar standard from 2029/2030. As at 14 October 2026 we have not checked whether that was agreed.

### Can the Inspectie sanction a school board that misses level 3?

As at 14 October 2026, not on the basis of the Normenkader IBP alone. The Inspectie van het Onderwijs can raise digital safety with a board in its stimulating role, for example based on the board's 2027 plan. The State Secretary wants the Inspectie to be able to intervene eventually and is exploring how to set that power in law. How a specific failure might be treated under existing education or data protection law is a question for counsel.

### Does meeting the Normenkader IBP make a school GDPR compliant?

Not on its own. The 25 privacy norms of the Normenkader IBP derive from the SURFaudit Toetsingskader Privacy, which in turn derives from a GDPR assurance product of the IBD and VNG. The GDPR still applies directly to every school board, and the Autoriteit Persoonsgegevens enforces it whatever a board's maturity score. Whether a given practice complies is a question for the board's data protection officer or counsel.

### How far are Dutch school boards from Normenkader IBP level 3?

Far. Self-evaluations from 485 boards, about 40% of the sector, averaged 1.7 out of 5 in the IBP in beeld survey published in March 2026: 1.5 for information security and 1.9 for privacy. No board averaged level 3 on information security. The scores are self-assessed and describe how measures are designed, not whether they work.

## Sources

- [Kamerbrief Digitale veiligheid in het funderend onderwijs (29 240, nr. 177)](https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2025Z19500&did=2025D45691) (Tweede Kamer · 5 November 2025)
- [Kamerbrief Digitale veiligheid funderend onderwijs (PDF)](https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/kamerstukken/2025/11/05/kamerbrief-digitale-veiligheid-funderend-onderwijs/Kamerbrief++-+Digitale+veiligheid+funderend+onderwijs+2025.pdf) (Rijksoverheid · 5 November 2025)
- [Kamerstuk 32 034, nr. 73: evaluation Wet gratis schoolboeken and IBP sector picture](https://zoek.officielebekendmakingen.nl/kst-32034-73.html) (Officiële Bekendmakingen · 2 April 2026)
- [IBP in beeld: a survey of maturity against the Normenkader IBP](https://www.eerstekamer.nl/nonav/overig/20260402/ibp_in_beeld_een_verkenning_van/document) (Programma Digitaal Veilig Onderwijs, via Eerste Kamer · 2 April 2026)
- [Veilige en goede ict in het onderwijs](https://www.rijksoverheid.nl/onderwerpen/digitalisering-onderwijs/veilige-en-goede-ict-in-het-onderwijs) (Rijksoverheid)
- [Normenkader IBP voor het onderwijs](https://normenkaderibp.kennisnet.nl/) (Kennisnet)
- [Normenkader IBP: changes](https://normenkaderibp.kennisnet.nl/wijzigingen/) (Kennisnet)
- [Normenkader IBP: how it was made](https://normenkaderibp.kennisnet.nl/totstandkoming/) (Kennisnet)
- [Digitaal veilig onderwijs in 2030 vraagt nu actie van schoolbesturen](https://vo-raad.nl/nieuws/digitaal-veilig-onderwijs-in-2030-vraagt-nu-actie-van-schoolbesturen) (VO-raad · 6 November 2025)
- [Digitale veiligheid: dit vraagt 2026 van schoolbesturen](https://vo-raad.nl/nieuws/digitale-veiligheid-dit-vraagt-2026-van-schoolbesturen) (VO-raad · 4 March 2026)
- [Eerste beeld funderend onderwijs op het vlak van digitaal veilig onderwijs](https://vo-raad.nl/nieuws/eerste-beeld-funderend-onderwijs-op-het-vlak-van-digitaal-veilig-onderwijs) (VO-raad · 3 April 2026)
- [Realistische planning nodig voor voldoen aan Normenkader IBP](https://vo-raad.nl/nieuws/realistische-planning-nodig-voor-voldoen-aan-normenkader-ibp) (VO-raad · 2 April 2025)
- [Verplicht aandacht voor informatiebeveiliging en privacy in het jaarverslag](https://vo-raad.nl/nieuws/verplicht-aandacht-voor-informatiebeveiliging-en-privacy-in-het-jaarverslag) (VO-raad · 28 January 2025)
- [Wat verandert er dit schooljaar? (2026/27)](https://vo-raad.nl/nieuws/wat-verandert-er-dit-schooljaar-2627) (VO-raad · 24 August 2026)