How SIDN’s Privacy Board oversees responsible data use
More than 10 years of assuring privacy in practice
When SIDN set up its own Privacy Board in 2014, privacy protection was not widely recognised as a priority within a lot of organisations. At the time, SIDN Labs was starting to study the traffic to the .nl name servers, using the ENTRADA research platform they had created. That development, combined with stricter European legislation – later to result in the General Data Protection Regulation (GDPR) – made it clear that the structural, expert review of data processing activities was essential. “It was a logical step,” recalls Karin Vink, SIDN’s Data Protection Officer and Chair of our Privacy Board. “We wanted to be able to innovate responsibly, with consideration for the privacy of all data subjects.”
Internal Privacy Board
Many enterprises now have one person, or even a whole team, tasked with privacy protection within the organisation. However, that was far from the norm in the registry world more than 10 years ago when we put together our multidisciplinary Privacy Board.The board is a permanent body with the authority to independently assess whether new projects, services and studies comply with the applicable legislation and regulations, and with SIDN’s own high data privacy standards.
Still topical
“Nowadays, privacy protection remains just as topical, but it’s an increasingly integral part of operations at many organisations. It’s relevant to every company and every other organisation, something that they need to act on and have a policy on. I’m struck by – and very pleased to see – just how privacy-aware SIDN personnel have become over the years. It means that our efforts to raise awareness have had an effect. Last year, for example, we got all the teams within SIDN to play a privacy-themed version of a popular Dutch board game. As they went around the board, players were confronted by issues and dilemmas relating to privacy and personal data processing. Then, this year, we set up a real escape room in the SIDN car park, where all the challenges related to security and privacy.
Multidisciplinary and independent body
SIDN’s Privacy Board is made up of people from departments that often handle personal data, including our Support Department and our research department, SIDN Labs. Since last year, the CISO has also been a member, so that privacy and security are mutually reinforcing. “That combination is very important. And, in most cases, privacy and security are mutually complementary interests,” says Karin. “Conflicts are more likely to arise between convenience and security than between privacy and security.”
Karin is SIDN’s Data Protection Officer. Therefore, as Chair of the Privacy Board, she concerns herself mainly with the process and with oversight, while the other board members perform the substantive analyses.
How does the review process work in practice?
A privacy policy has to be drawn up for every new project, service or study that will involve personal data processing. That policy then has to be submitted to the Privacy Board for review. Without the board’s approval, the initiative can’t go ahead. Privacy policies are drawn up using a template, with mandatory sections defining the purpose of the activity, the categories of data to be processed, the legitimate basis for processing and the associated risks. The board then reviews the policy, following a fixed procedure:
Analysis of the proposal The board considers whether the proposed processing is consistent with the GDPR and SIDN’s internal policies. Particular attention is given to the legitimate basis – often ‘reasonable interest’ – and the need for processing.
In-depth interviews The Privacy Board interviews the colleagues that submitted the privacy policy to obtain clarification, and information about alternatives or the scope for using less personal data.
Decentralisation and data minimisation review Is the proposed processing proportional? Could the research goals be secured using less data or less detailed data? The board addresses such questions in line with an internal assessment framework.
Judgement and publication The Privacy Board’s judgement is documented. Wherever possible, the privacy policies and reviews are published. However, privacy policies that contain commercially sensitive information and those that relate to the processing of personal data exclusively about SIDN personnel remain internal.
The procedure described has never yet led to a project being totally rejected. “What does happen,” says Karin, “is that something is flagged up during the interviews with the colleagues who submitted a privacy policy, leading to revisions. So, together, we arrive at more intelligent, secure or efficient personal data processing.”
Privacy and security are not at odds
SIDN operates a vital part of the Netherlands’ digital infrastructure, which millions of people make use of every day. Clearly, therefore, the security of the .nl domain is vital – but how does that relate to privacy? According to Karin, security and privacy are often mutually complementary. “A lot of our data processing is intended to make the internet more secure. And the data subjects are not affected by the processing, except insofar as security improves.”
It’s nevertheless vital that there is always a legitimate basis for processing. Our reasonable interest in the stability and security of .nl often provides the legal basis for processing. By reviewing proposed projects at an early stage, the board prevents conflicts between the interests at stake.
Growing risks posed by data and AI
Asked about the impact of AI and other developments, Karin responds: “New technologies bring new challenges. We see and hear evidence of that every day in the news. The amount of available data is growing, and it’s getting easier and easier to combine data from various sources. That enables conclusions to be drawn, including conclusions that relate to individual people. Increasingly, that’s done using AI – with all the attendant risks. Now, although the personal data that SIDN processes is not extremely sensitive, once AI is involved, the need for a critical Privacy Board is all the greater.”
Upcoming developments and awareness
In 2026, our Privacy Board will continue to pay particular attention to developments in the field of AI and its potential impact on SIDN’s personal data processing. “And, of course, we’ve got another good awareness campaign coming up for our personnel, because a continuous focus on privacy remains important,” asserts Karin.
All privacy policies and the associated Privacy Board reviews are published on our website: https://www.sidn.nl/en/about-sidn/privacy-board.
