Privacy and your Personal Data
The Netherlands Tax Administration (NTA) treats your personal data with care. The General Data Protection Regulation (GDPR), the European Privacy Act, sets requirements for the way in which we process your personal data. We only use personal data to exercise our legal tasks and for purposes that are directly related to those duties. And we make sure that you can easily invoke the rights that GDPR grants you in connection with the processing of your personal data by the Netherlands Tax Administration.
We take all measures necessary to protect your information. All our employees have a duty of confidentiality and our computers and buildings are also protected. Our privacy statement is a specification of the privacy statement of the Ministry of Finance (available in Dutch only).
Below on this page
- What are personal data?
- How do we protect personal data?
- How do we obtain your personal data?
- With whom do we share your personal data?
- What are the bases for the processing of personal data?
- How do we apply automated decision-making and profiling?
- How long do we store your personal data?
- What do we do in case of a data leak?
- How do we deal with your privacy at the Tax Information Line and at the counter of a tax office?
- How do we handle your personal data during and after the use of our websites or apps?
- Would you like to see which personal data we process?
- Do you want to change your data?
- Do you want to have your personal data erased?
- Do you want to object to the processing of your personal data?
- Do you want to restrict the processing of your personal data?
- What does the Data Protection Officer do?
- Do you have a question or a complaint in connection with the processing of your personal data?
- Looking for more information about the General Data Protection Regulation (GDPR)?
What are personal data?
Personal data are pieces of information that relate to an identified or identifiable natural person. Examples of personal data include identifying data such as your citizen service number and contact information such as your name and address, as well as data on income and wealth.
Some personal data are considered by the GDPR to be 'special categories of personal data'. Among other things, the Tax Administration processes the following special personal data:
- religion or belief
- union membership
- health
- criminal past
How do we protect personal data?
The Tax Administration takes appropriate measures to prevent misuse, loss, unauthorised access, undesirable disclosure and unauthorised alteration of data.
We do this by ensuring that our buildings are not accessible to unauthorised persons and by ensuring that our automation systems are well protected against external attacks and data leaks. The Tax Administration has agreements on which employees are allowed to use certain data and for what purpose.
How do we obtain your personal data?
The Tax Administration receives information from citizens and businesses themselves. Sometimes because it is required by law to provide us with information, such as when filing a tax return or applying for benefits. We can also request your contact details while filling out a form on our website, or your telephone number when contacting us by phone. The Tax Administration uses these contact details to improve our service.
The Tax Administration also receives personal data from other organisations. These other organisations do so because they are legally obliged to provide this information, whether or not at the request of the Tax Administration. This includes, for example, data on benefits from the Employee Insurance Agency (UWV), data from banks on the balance of accounts, or data from pension funds on pension income.
With whom do we share your personal data?
The Tax Administration has a duty of confidentiality with regard to the information it holds. This means that we cannot share the data with others. We are only allowed to share data:
- if it is necessary for the performance of our duties, or
- if laid down by law, or
- in special cases with an exemption from the Minister of Finance
Authorities to which the Tax Administration provides information include the following:
- Statistics Netherlands (CBS)
- Employee Insurance Agency (UWV, for the execution of the Unemployment Insurance Act (WW), Work and Income (Capacity for Work) Act (WIA), Invalidity Insurance (Self-Employed Persons) Act (WAZ), the Work and Care Act (Wazo) and the Sickness Benefits Act)
- The Social Insurance Bank (SVB for, among other things, the execution of Old-age Pensions (AOW), Child Benefit and Personal Care Budget (PGB)
- Municipalities (for the implementation of the Social Support Act (Wmo) and the Participation Act)
- Foreign tax authorities (on the basis of EU rules and treaties)
When providing data to other organisations, the Tax Administration must also comply with rules on the protection and security of personal data. For this reason, the Tax Administration makes agreements with the parties to whom data are provided. These agreements concern, among other things, the procedures to be followed in the provision of information, security, etc. These agreements are laid down in covenants. The Tax Administration publishes this information on this website on the page: Convenanten (available in Dutch only).
The Tax Administration holds the Basic Registration of Income (BRI). The so-called 'authentic income data' is laid down in this register. This is the income that you will also find on your tax assessment. In order to limit the administrative burden, government organisations prefer to use the income generated by the BRI to carry out their tasks. The Tax Administration will provide them with that information from the BRI. This means that you do not have to submit this information over and over again when applying for a benefit, for example.
If organisations, like IT companies, carry out work on behalf of the Tax Administration in which data are processed we will conclude a processing agreement with that organisation. Agreements are made to ensure that your data is just as well protected as when it is processed by the Tax Administration itself. The Tax Administration remains responsible for these processing operations.
What are the bases for the processing of personal data?
The Tax Administration only uses personal data if this is permitted under the GDPR. This states that personal data may be processed:
- if it has been expressly authorised, or
- if necessary for the performance of a contract, or
- if necessary for a legitimate interest of an organisation, or
- if necessary in order to comply with a legal obligation, or
- if necessary for the performance of a task of general interest laid down by law
In most cases, the Tax Administration processes your personal data on the basis of a statutory obligation or in order to perform a task of general interest stipulated by law. In some cases, we process data on the basis of your consent, an agreement or a legitimate interest.
The purposes for which the Tax Administration processes data derive from the statutory tasks: levying, paying out, collecting, exercising goods supervision and investigating offences relating to all these matters. We also use the data collected for these purposes for monitoring and service purposes.
We use data to levy and collect national taxes, social insurance contributions and other taxes that have to be paid. Examples of national taxes are wage and income tax, motor vehicle tax, inheritance and gift tax, transfer tax, value-added tax, taxes on the import of goods and excise duties. We do this on the basis of the General Tax Act, the Collection of State Taxes Act and the various tax laws.
The Tax Administration also uses data for the purpose of paying benefits. It concerns data for calculating your benefits and for paying them out. And if it is necessary in order to reclaim overpayments from you. This concerns rent benefit, health care benefit, childcare benefit and supplementary child benefit. We do this on the basis of the General Act on income-related schemes and the various benefit laws.
Customs is part of the Netherlands Tax Administration. Customs collects and levies taxes on imports, levies and collects domestic excise duties and consumption taxes, and ensures that the import, export and transit of goods are carried out in accordance with the rules. Customs does this on the basis of the Union Customs Code and the General Customs Act. If goods are not allowed into the European Union or the Netherlands Customs will ensure that the goods do not enter. Customs carries out its enforcement duties on behalf of the European Union (EU), the Ministry of Finance and at the direction or request of other ministries and enforcing bodies. For more information visit Customs.
The Fiscal Intelligence and Investigation Service (Fiscale Inlichtingen- en Opsporingsdienst, FIOD) processes personal data that are necessary for the performance of its police duties. This task is set out in Article 3 of the Special Investigative Services Act. The personal data processed by the FIOD in this context are processed in accordance with the Police Data Act. In addition, the FIOD has other activities that cannot be classified under its police function. These activities are often carried out in so-called 'contact points', including the Central Notification Point for Bankruptcy Fraud and the Office for the Disclosure of Unusual Transactions. Processing of personal data in the context of these tasks falls under the regime of the GDPR.
For more information about the purposes for which we process your data and which data we process, please read the brochure: Overzicht verwerkingen van persoonsgegevens door de Belastingdienst (available in Dutch only).
How do we apply automated decision-making and profiling?
The GDPR defines automated decision-making (including profiling) as the ability to make decisions by technological means without significant human involvement. Profiling involves the automated processing of personal data with a view to evaluating or predicting personal aspects such as the economic situation, reliability or likely behaviour of a person. In automated decision-making without profiling, personal aspects are not taken into account for evaluation or prediction.
The Dutch Tax Administration decides about taxes and benefits for millions of Dutch citizens. This makes the use of automated decision-making imperative. Examples of automated decisions are the granting and annual continuation of benefits, determining if someone is overdue filing a tax return or paying tax, or correcting a VAT return. The Tax Administration decides automatically on the basis of the personal data you provide us with. We also use information from other organisations for automated decision-making. Automated decisions without the use of profiling are permitted by the GDPR Implementation Act.
We aim to be transparent about the way in which automated decisions are made. For example, the Tax Administration makes tools available for filing online tax returns via the web portal 'Mijn Belastingdienst'. On the portal 'Mijn toeslagen' we offer application forms and modules for test calculations, and for various types of taxes we have paper tax return forms. These tools have been designed in such a way that they provide maximum insight into the decision and calculation rules the Dutch Tax Administration applies when making decisions.
The Dutch Tax Administration does decide automatically on the basis of profiling as defined in the GDPR. The Tax Administration does, however, make use of personal aspects to select files for the inspection of tax returns or granted benefits. Files selected in this way are always assessed by a human being and that person also makes the decision.
How long do we store your personal data?
For the storage and destruction of data, the Tax Administration uses the terms laid down in selection lists which can be viewed on the website of the National Archives www.nationaalarchief.nl/archiveren/, search term: selectielijst Belastingdienst (available in Dutch only). These selection lists state when data is to be destroyed and which data is to be kept permanently.
What do we do in case of a data leak?
There is a data leak if personal data has been stolen or lost from the Tax Administration.
Examples of data leaks are:
- a lost USB memory device containing personal data
- a stolen laptop
- a digital break-in into a database by a hacker
- a malware infection of a computer, server or computer network
- a calamity such as a fire in a data centre
For each identified data leak, the Tax Administration investigates whether personal data of a special or sensitive nature have leaked, such as copies of identity documents or citizens service numbers.
The Tax Administration has taken every possible measure to prevent data leaks from happening. If there is a data leak we will take measures to limit the impact as quickly as possible.
The Tax Administration will report a data leak to the Dutch Data Protection Authority. In the event of a data leak with potentially serious adverse consequences, the Tax Administration will also report this to those whose personal data have been leaked.
Do you have any indications or the impression that your data in the Tax Administration's computers are not secure? Or do you have any indications of misuse of personal data? Then please go to the following webpage: Data leak, vulnerability, or abuse of our computer systems? Please report it.
Or call the Tax Information Line, 0800 - 0543 (free calls from the Netherlands).
From abroad please call: + 31 555 385 385.
How does The Tax Administration deal with your privacy at the Tax Information Line and at the counter of a tax office?
Do you have contact with the Tax Administration via the Tax Information Line? When answering questions by telephone, we use the information available to us as much as possible. Because much of this information is personal, we believe it is very important to check whether we are speaking to the right person. If you are calling the Tax Information Line with a question for which we need to look at your personal information, we will ask you to first name certain details only you would know. This prevents data from reaching people who are not entitled to it.
We never pass on any specific personal information by telephone. This includes, for example, citizen service numbers, dates of birth and address details.
Your call to the Tax Information Line may be recorded. We will in any case retain your telephone number. If you choose to enter your civil service number, this will be retained as well. These data are collected to improve our service.
Your call to the Tax Information Line can also be recorded for quality purposes. If your conversation is part of our quality control and it appears our answer to your question leaves room for improvement, we will call you back. Recordings will be erased after 6 weeks.
Do you have a dispute about the content of a telephone call with the Tax Information Line? And was that conversation recorded and still available? Then you have the right to listen to the telephone call or to receive a transcribed version of it.
Do you have contact with the Tax Administration via the counter of a tax office? Then we ask for a valid proof of identity.
How do we handle your personal data during and after the use of our websites or apps?
Are you visiting one of our websites or using one of our apps? Below is an explanation of the cookies, statistics and personal data you leave when doing so.
Cookies
The Tax Administration uses technical and functional cookies on its websites. A cookie is a small text file that is stored on your computer, tablet or smartphone when you visit a website for the first time. They help you with the technical operation of the website and increase its ease of use. And they help us to optimize our websites and apps, and to better align them with your needs.
Cookies make it possible, for example, to choose a language or to recognise repeat visits. We also use cookies to collect information about the use of our websites and apps.
Our cookies only contain a unique number, no personal data. We do not use cookies to identify you personally.
You can prevent cookies from being placed by setting your internet browser in such a way that it no longer stores cookies. Or you can delete all cookies stored in the settings of your browser.
Statistics
We also use analytical cookies on our websites and in our apps. This allows us to collect statistic data on the use of our websites and apps. Statistics help to improve the websites.
We do not make the data collected available for any purpose other than statistics. We also do not make the data collected through cookies available to third parties.
We collect the following data via analytical cookies for use in the Tax Administration's statistics:
- your IP address (without the last two digits)
- the address of your internet service provider
- the browser you are using - such as Internet Explorer or Firefox
- the time and duration of your visit
- the pages that you visit
How do we deal with personal data that you enter on our website or in our apps?
If you are required to enter personal data on our websites or in our apps, we will only use that data for the purpose for which you have entered it.
You fill in your name and address to send us a form. In that case, we will use this data for that purpose only, and not to send you other forms or information.
If you commit a criminal offence via our websites or apps or make criminal statements, we can use your own personal data for the investigation, detection and prosecution of those offences, or for the execution of criminal penalties. This includes the protection and prevention of threats to public security, and the prevention of further criminal offences.
How do we deal with the personal data of visitors under the age of 16 to our websites and apps?
Is the visitor to the Tax Administration's website younger than 16 years of age? In that case, the processing of personal data requires the consent of the legal representative.
The Tax Administration cannot check whether a minor who visits our website or uses our apps has this permission. As a result, it is possible that we sometimes process data of persons under the age of 16.
Would you like to know whether the Tax Administration has processed personal data about a person under the age of 16 without the consent of the parent or guardian? Or are you convinced that the Tax Administration has processed personal data about a person under the age of 16 without the consent of the parent or guardian and you, as parent or guardian, don't want that? Please write a letter about this to:
Belastingdienst
Postbus 2508
6401 DA Heerlen
Would you like to see which personal data we process?
If you want to see which personal data the Tax Administration processes, please visit the Tax Administration's portals. There you will find most of the personal data that the Tax Administration processes about you.
For personal data for private tax purposes? Please visit Inloggen op Mijn Belastingdienst (for tax matters only, available in Dutch only).
For personal data for the purpose of granting benefits? Please visit Inloggen op 'Mijn toeslagen' (available in Dutch only).
Do you want to know for what purpose and on what basis the Tax Administration processes your personal data, and from whom we receive your personal data and to whom we provide it, and what categories of personal data we process? Then please read the brochure: Overzicht verwerkingen van persoonsgegevens door de Belastingdienst (available in Dutch only).
After consulting the above, do you still have questions about the personal data the Tax Administration processes about you? Then you can submit a request for access by writing us a letter. Please, include contact details, such as your name, address, postal code and place of residence, and the telephone number on which you can be reached during the day. Send your request to the following address:
Belastingdienst
Postbus 2508
6401 DA Heerlen
The Tax Administration will usually make a decision within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.
Do you want to change your data?
Learn how and where to change or adjust the following data:
Changing your address
Please visit Hoe geef ik een adreswijziging door? (available only Dutch)
Changing your bankaccount number
Please visit Hoe geef ik mijn rekeningnummer door - en hoe pas ik het aan? (available in Dutch only)
Adjusting benefits
Please visit Benefits – I want to submit a change
Adjusting the provisional income tax return
Please visit In 4 stappen zelf online uw voorlopige aanslag wijzigen (available in Dutch only)
Adjusting pre-filled data in the income tax return
Please visit De vooraf ingevulde gegevens kloppen niet helemaal - hoe pas ik ze aan? (available in Dutch only)
Adjusting your income tax return
Please visit Ik heb een foutje gemaakt in mijn aangifte inkomstenbelasting, maar ik heb hem al verstuurd - wat nu? (available in Dutch only)
Adjusting your inheritance tax return
Please visit Ik heb mijn aangifte erfbelasting al verstuurd - kan ik 'm nog wijzigen? (available in Dutch only)
Adjusting your gift tax return
Please visit Fout gemaakt in aangifte schenkbelasting? Zo herstelt u dat (available in Dutch only)
Adjusting your payment scheme
Please visit Kan ik mijn betalingsregeling nog aanpassen? (available in Dutch only)
Adjusting the VAT return
Please visit Ik heb te veel of te weinig btw ingevuld - hoe wijzig ik mijn aangifte? (available in Dutch only)
For entrepreneurs: completing or amending returns
Please visit Ondernemers: Aangiften aanvullen of wijzigen (available in Dutch only)
If you are not able to change your data via one of the previous options, for example, if your name has been misspelled, please write us a letter. Set out which data you want to have changed. Include your contact details, such as your name, address, postal code and place of residence, and the telephone number on which you can be reached during the day. Send your letter to:
Belastingdienst
Postbus 2508
6401 DA Heerlen
The Tax Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.
If your personal data are indeed incorrect or incomplete, the Tax Administration will correct it. You will receive a message about this.
Has the Tax Administration given these incorrect personal details to other organisations? In that case, the Tax Administration will provide the right data the next time around.
Do you want to have your personal data erased?
In some cases, you may have the right to have your personal information that we have on you erased. This is possible, for example, if we keep information about you that is not or no longer needed to carry out our work.
Can you not delete the data yourself by changing your data? (see above: Do you want to change your data?) Then write a letter. Please state what information is not (or no longer) necessary in your opinion to carry out the Tax Administration's work properly. Send your letter to:
Belastingdienst
Postbus 2508
6401 DA Heerlen
The Tax Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.
Does the Tax Administration agree with you? In that case, the Tax Administration will remove the data from the administration.
Do we refuse to delete your data? If so, you will receive a decision stating why the Tax Administration rejects your request.
Do you want to object to the processing of your personal data?
If you do not want your data to be used by the Tax Administration, for example for certain calculations or for other activities involving the levying of taxes or the payment of benefits, you can put in a request with the Tax Administration. Write a letter. Please state which data may not be used in which calculations or activities.
Send your letter to:
Belastingdienst
Postbus 2508
6401 DA Heerlen
The Tax Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.
Does the Tax Administration agree with you? In that case, we will not use the data mentioned. You will be notified.
Do we not agree with you? If so, you will receive a decision stating why the Tax Administration rejects your request.
Do you want to restrict the processing of your personal data?
If you are of the opinion that the Tax Administration is not allowed to use certain data you can make a request to restrict the processing. This can be done, for example:
- if your personal data is incorrect
- if you are of the opinion that the processing by the Tax Administration is unlawful
- if you consider that certain data are no longer required for processing
- if you have objected to a processing operation and are awaiting the decision on it
Write a letter and please state which data you want to restrict the processing of.
Send your letter to:
Belastingdienst
Postbus 2508
6401 DA Heerlen
What does the Data Protection Officer do?
The Ministry of Finance has appointed a Data Protection Officer. The Data Protection Officer checks whether the rules for the protection of personal data are properly applied and complied with by the Tax Administration. The Data Protection Officer is an internal supervisor and has an independent position. More information about the duties of the Data Protection Officer can be found on the website of the Dutch Data Protection Authority (Dutch DPA) Autoriteit Persoonsgegevens (available in Dutch only).
Do you have a question or a complaint in connection with the processing of your personal data?
Do you have a question about the way in which the Tax Administration handles your personal data or a complaint in connection with the implementation of the GDPR? If so, write a letter. State your complaint or question and state that it concerns the Netherlands Tax Administration.
Send your letter to:
Ministerie van Financiën
Functionaris voor Gegevensbescherming
Postbus 20 201
2500 EE Den Haag
Send your email to: fg@minfin.nl.
The Dutch DPA monitors compliance with privacy legislation externally. You have the right to lodge a complaint with the authority about the Tax Administration.
Looking for more information about the General Data Protection Regulation (GDPR)?
You can find more information about the GDPR on or in the following:
- Website: Autoriteit Persoonsgegevens (Dutch DPA)
- Website: rijksoverheid.nl use search term: AVG (available in Dutch only)
- Brochure: Overzicht verwerkingen van persoonsgegevens door de Belastingdienst (available in Dutch only)
