Privacy and your personal data

The Netherlands Tax and Customs Administration (NTCA) treats your personal data with care. The General Data Protection Regulation (GDPR), the European Privacy Act, sets requirements for the way in which we process your personal data. We only use personal data to exercise our legal tasks and for purposes that are directly related to those duties. And we make sure that you can easily invoke the rights that GDPR grants you in connection with the processing of your personal data by the Netherlands Tax and Customs Administration.

We take all measures necessary to protect your information. All our employees have a duty of confidentiality and our computers and buildings are also protected. This privacy statement is a specification of the privacy statement of the Ministry of Finance (available in Dutch only).

Below on this page

What are personal data?

Personal data are pieces of information that relate to an identified or identifiable natural person. Examples of personal data include identifying data such as your citizen service number and contact information such as your name and address, as well as data on income and wealth.

Some personal data are considered by the GDPR to be 'special categories of personal data'. Among other things, the Tax and Customs Administration processes the following special personal data:

  • religion or belief
  • union membership
  • health
  • criminal past

To the top of this page

How do we protect personal data?

The Tax and Customs Administration takes appropriate measures to prevent misuse, loss, unauthorised access, undesirable disclosure and unauthorised alteration of data.

We do this by ensuring that our buildings are not accessible to unauthorised persons and by ensuring that our automation systems are well protected against external attacks and data leaks. The Tax and Customs Administration has agreements on which employees are allowed to use certain data and for what purpose.

To the top of this page

How do we obtain your personal data?

The Tax and Customs Administration receives information from citizens and businesses themselves. Sometimes because it is required by law to provide us with information, such as when filing a tax return, but also, for example, by logging in via our websites, by telephone or by correspondence.

The Tax and Customs Administration also receives personal data from other organisations. These other organisations do so because they are legally obliged to provide this information, whether or not at the request of the Tax and Customs Administration. This includes, for example, data on benefits from the Employee Insurance Agency (UWV), data from banks on the balance of accounts, or data from pension funds on pension income.

To the top of this page

With whom do we share your personal data?

The Tax and Customs Administration has a duty of confidentiality with regard to the information it holds. This means that we cannot share the data with others. We are only allowed to share data:

  • if it is necessary for the performance of our duties, or
  • if laid down by law, or
  • in special cases with an exemption from the Minister of Finance

Authorities to which the Tax and Customs Administration provides information include the following:

  • Statistics Netherlands (CBS)
  • Employee Insurance Agency (UWV, for the execution of the Unemployment Insurance Act (WW), Work and Income (Capacity for Work) Act (WIA), Invalidity Insurance (Self-Employed Persons) Act (WAZ), the Work and Care Act (Wazo) and the Sickness Benefits Act)
  • The Social Insurance Bank (SVB for, among other things, the execution of Old-age Pensions (AOW), Child Benefit and Personal Care Budget (PGB)
  • Municipalities (for the implementation of the Social Support Act (Wmo) and the Participation Act)
  • Foreign tax authorities (on the basis of EU rules and treaties)

When providing data to other organisations, the Tax and Customs Administration must also comply with rules on the protection and security of personal data. For this reason, the Tax and Customs Administration makes agreements with the parties to whom data are provided. These agreements concern, among other things, the procedures to be followed in the provision of information, security, etc. These agreements are laid down in covenants. The Tax and Customs Administration publishes this information on this website on the page: Convenanten (available in Dutch only).

The Tax and Customs Administration holds the Basic Registration of Income (BRI). The so-called 'authentic income data' is laid down in this register. This is the income that you will also find on your tax assessment. In order to limit the administrative burden, government organisations prefer to use the income generated by the BRI to carry out their tasks. The Tax and Customs Administration will provide them with that information from the BRI. This means that you do not have to submit this information over and over again when applying for a benefit, for example.

If organisations, like IT companies, carry out work on behalf of the Tax and Customs Administration in which data are processed we will conclude a processing agreement with that organisation. Agreements are made to ensure that your data is just as well protected as when it is processed by the Tax and Customs Administration itself. The Tax and Customs Administration remains responsible for these processing operations.

To the top of this page

What are the bases for the processing of personal data?

The Tax and Customs Administration only uses personal data if this is permitted under the GDPR. This states that personal data may be processed:

  • if it has been expressly authorised, or
  • if necessary for the performance of a contract, or
  • if necessary for a legitimate interest of an organisation, or
  • if necessary in order to comply with a legal obligation, or
  • if necessary for the performance of a task of general interest laid down by law


In most cases, the Tax and Customs Administration processes your personal data on the basis of a statutory obligation or in order to perform a task of general interest stipulated by law. In some cases, we process data on the basis of your consent, an agreement or a legitimate interest.

The purposes for which the Tax and Customs Administration processes data derive from the statutory tasks: levying, paying out, collecting, exercising goods supervision and investigating offences relating to all these matters. We also use the data collected for these purposes for monitoring and service purposes.

We use data to levy and collect national taxes, social insurance contributions and other taxes that have to be paid. Examples of national taxes are wage and income tax, motor vehicle tax, inheritance and gift tax, transfer tax, value-added tax, taxes on the import of goods and excise duties. We do this on the basis of the General Tax Act, the Collection of State Taxes Act and the various tax laws.

The Tax and Customs Administration also uses data for the purpose of paying benefits. It concerns data for calculating your benefits and for paying them out. And if it is necessary in order to reclaim overpayments from you. This concerns rent benefit, health care benefit, childcare benefit and supplementary child benefit. We do this on the basis of the General Act on income-related schemes and the various benefit laws.

Customs is part of the Netherlands Tax and Customs Administration. Customs collects and levies taxes on imports, levies and collects domestic excise duties and consumption taxes, and ensures that the import, export and transit of goods are carried out in accordance with the rules. Customs does this on the basis of the Union Customs Code and the General Customs Act. If goods are not allowed into the European Union or the Netherlands Customs will ensure that the goods do not enter. Customs carries out its enforcement duties on behalf of the European Union (EU), the Ministry of Finance and at the direction or request of other ministries and enforcing bodies. For more information visit Customs.

The Fiscal Intelligence and Investigation Service (Fiscale Inlichtingen- en Opsporingsdienst, FIOD) processes personal data that are necessary for the performance of its police duties. This task is set out in Article 3 of the Special Investigative Services Act. The personal data processed by the FIOD in this context are processed in accordance with the Police Data Act. In addition, the FIOD has other activities that cannot be classified under its police function. These activities are often carried out in so-called 'contact points', including the Central Notification Point for Bankruptcy Fraud and the Office for the Disclosure of Unusual Transactions. Processing of personal data in the context of these tasks falls under the regime of the GDPR.

For more information about the purposes for which we process your data and which data we process, please read the brochure: Overzicht verwerkingen van persoonsgegevens door de Belastingdienst (available in Dutch only).

To the top of this page

How do we apply automated decision-making and profiling?

The GDPR defines automated decision-making (including profiling) as the ability to make decisions by technological means without significant human involvement. Profiling involves the automated processing of personal data with a view to evaluating or predicting personal aspects such as the economic situation, reliability or likely behaviour of a person. In automated decision-making without profiling, personal aspects are not taken into account for evaluation or prediction.

The Dutch Tax and Customs Administration decides about taxes and benefits for millions of Dutch citizens. This makes the use of automated decision-making imperative. Examples of automated decisions are the granting and annual continuation of benefits, determining if someone is overdue filing a tax return or paying tax, or correcting a VAT return. The Tax and Customs Administration decides automatically on the basis of the personal data you provide us with. We also use information from other organisations for automated decision-making. Automated decisions without the use of profiling are permitted by the GDPR Implementation Act.

We aim to be transparent about the way in which automated decisions are made. For example, the Tax and Customs Administration makes tools available for filing online tax returns via the web portal MijnBelastingdienst. On the portal MijnToeslagen we offer application forms and modules for test calculations, and for various types of taxes we have paper tax return forms. These tools have been designed in such a way that they provide maximum insight into the decision and calculation rules the Dutch Tax and Customs Administration applies when making decisions.

The Dutch Tax and Customs Administration does decide automatically on the basis of profiling as defined in the GDPR. The Tax and Customs Administration does, however, make use of personal aspects to select files for the inspection of tax returns or granted benefits. Files selected in this way are always assessed by a human being and that person also makes the decision.

To the top of this page

How long do we store your personal data?

For the storage and destruction of data, the Tax and Customs Administration uses the terms laid down in selection lists which can be viewed on the website of the National Archives www.nationaalarchief.nl/archiveren/, search term: selectielijst Belastingdienst (available in Dutch only). These selection lists state when data is to be destroyed and which data is to be kept permanently.

To the top of this page

What do we do in case of a data leak?

There is a data leak if personal data has been stolen or lost from the Tax and Customs Administration.

Examples of data leaks are:

  • a lost USB memory device containing personal data
  • a stolen laptop
  • a digital break-in into a database by a hacker
  • a malware infection of a computer, server or computer network
  • a calamity such as a fire in a data centre

For each identified data leak, the Tax and Customs Administration investigates whether personal data of a special or sensitive nature have leaked, such as copies of identity documents or citizens service numbers.

The Tax and Customs Administration has taken every possible measure to prevent data leaks from happening. If there is a data leak we will take measures to limit the impact as quickly as possible.

The Tax and Customs Administration will report a data leak to the Dutch Data Protection Authority. In the event of a data leak with potentially serious adverse consequences, the Tax and Customs Administration will also report this to those whose personal data have been leaked.

Do you have any indications or the impression that your data in the Tax and Customs Administration's computers are not secure? Or do you have any indications of misuse of personal data? Then please go to the following webpage: Data leak, vulnerability, or abuse of our computer systems? Please report it.

Or call the Customs Information Line, 0800 – 0543 (free calls from the Netherlands).
|From abroad please call: + 31 45 574 30 31.

To the top of this page

How do we deal with your privacy at the Tax Information Line and at the counter of a tax office?

Do you have contact with the Tax and Customs Administration via the Tax Information Line? When answering questions by telephone, we use the information available to us as much as possible. Because much of this information is personal, we believe it is very important to check whether we are speaking to the right person. If you are calling the Tax Information Line with a question for which we need to look at your personal information, we will ask you to first name certain details only you would know. This prevents data from reaching people who are not entitled to it.

We never pass on any specific personal information by telephone. This includes, for example, citizen service numbers, dates of birth and address details.

Your call to the Tax Information Line can be recorded for quality purposes. Recorded calls are not stored any longer than necessary, and will be erased after 6 weeks in all cases.

Do you have a dispute about the content of a telephone call with the Tax Information Line? And was that conversation recorded and still available? Then you have the right to listen to the telephone call or to receive a transcribed version of it.

Do you have contact with the Tax and Customs Administration via the counter of a tax office? Then we ask for a valid proof of identity.

To the top of this page

How do we handle your personal data during and after the use of our websites or apps?

Are you visiting one of our websites or using one of our apps? Below is an explanation of the cookies, statistics and personal data you leave when doing so.

Cookies

The Tax and Customs Administration uses technical and functional cookies on its websites. A cookie is a small text file that is stored on your computer, tablet or smartphone when you visit a website for the first time. They help you with the technical operation of the website and increase its ease of use. And they help us to optimize our websites and apps, and to better align them with your needs.

Cookies make it possible, for example, to choose a language or to recognise repeat visits. We also use cookies to collect information about the use of our websites and apps.

Our cookies only contain a unique number, no personal data. We do not use cookies to identify you personally.

You can prevent cookies from being placed by setting your internet browser in such a way that it no longer stores cookies. Or you can delete all cookies stored in the settings of your browser.

Statistics

We also use analytical cookies on our websites and in our apps. This allows us to collect statistic data on the use of our websites and apps. Statistics help to improve the websites.

We do not make the data collected available for any purpose other than statistics. We also do not make the data collected through cookies available to third parties.

We collect the following data via analytical cookies for use in the Tax and Customs Administration's statistics:

  • your IP address
  • the address of your internet service provider
  • the browser you are using - such as Internet Explorer or Firefox
  • the time and duration of your visit
  • the pages that you visit

To the top of this page

How do we deal with personal data that you enter on our website or in our apps?

If you are required to enter personal data on our websites or in our apps, we will only use that data for the purpose for which you have entered it.

Example
You fill in your name and address to send us a form. In that case, we will use this data for that purpose only, and not to send you other forms or information.

If you commit a criminal offence via our websites or apps or make criminal statements, we can use your own personal data for the investigation, detection and prosecution of those offences, or for the execution of criminal penalties. This includes the protection and prevention of threats to public security, and the prevention of further criminal offences.

To the top of this page

How do we deal with the personal data of visitors under the age of 16 to our websites and apps?

Is the visitor to the Tax and Customs Administration's website younger than 16 years of age? In that case, the processing of personal data requires the consent of the legal representative.

The Tax and Customs Administration cannot check whether a minor who visits our website or uses our apps has this permission. As a result, it is possible that we sometimes process data of persons under the age of 16.

Would you like to know whether the Tax and Customs Administration has processed personal data about a person under the age of 16 without the consent of the parent or guardian? Or are you convinced that the Tax and Customs Administration has processed personal data about a person under the age of 16 without the consent of the parent or guardian and you, as parent or guardian, don't want that? Please write a letter about this to:

Belastingdienst
Postbus 2508
6401 DA Heerlen

To the top of this page

Would you like to see which personal data we process?

If you want to see which personal data the Tax and Customs Administration processes, please visit the Tax and Customs Administration's portals. There you will find most of the personal data that the Tax and Customs Administration processes about you.

For personal data for private tax purposes? Please visit Inloggen op Mijn Belastingdienst (for tax matters only, available in Dutch only).

For personal data for the purpose of granting benefits? Please visit Inloggen op MijnToeslagen (available in Dutch only).

Do you want to know for what purpose and on what basis the Tax and Customs Administration processes your personal data, and from whom we receive your personal data and to whom we provide it, and what categories of personal data we process? Then please read the brochure: Overzicht verwerkingen van persoonsgegevens door de Belastingdienst  (available in Dutch only).

After consulting the above, do you still have questions about the personal data the Tax and Customs Administration processes about you? Then you can submit a request for access by writing us a letter. Please, also include your citizen service number (BSN) and contact details, such as your name, address, postal code and place of residence, and the telephone number on which you can be reached during the day. Send your request to the following address:

Belastingdienst
Postbus 2508
6401 DA Heerlen

The Tax and Customs Administration will usually make a decision within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.

To the top of this page

Do you want to change your data?

Learn how and where to change or adjust the following data:

Changing your address
Please visit Hoe geef ik een adreswijziging door? (available only Dutch)

Changing your bankaccount number
Please visit Hoe geef ik mijn rekeningnummer door - en hoe pas ik het aan? (available in Dutch only)

Adjusting benefits
Please visit Benefits – I want to submit a change

Adjusting the provisional income tax return
Please visit Mijn voorlopige aanslag klopt niet - wat nu? (available in Dutch only)

Adjusting pre-filled data in the income tax return
Please visit De vooraf ingevulde gegevens kloppen niet helemaal - hoe pas ik ze aan? (available in Dutch only)

Adjusting your income tax return
Please visit Ik heb een foutje gemaakt in mijn aangifte inkomstenbelasting, maar ik heb hem al verstuurd - wat nu? (available in Dutch only)

Adjusting your inheritance tax return
Please visit Ik heb mijn aangifte erfbelasting al verstuurd - kan ik 'm nog wijzigen? (available in Dutch only)

Adjusting your gift tax return
Please visit Fout gemaakt in aangifte schenkbelasting? Zo herstelt u dat (available in Dutch only)

Adjusting your payment scheme
Please visit Kan ik mijn betalingsregeling nog aanpassen? (available in Dutch only)

Adjusting the VAT return
Please visit Ik heb te veel of te weinig btw ingevuld - hoe wijzig ik mijn aangifte? (available in Dutch only)

For entrepreneurs: completing or amending returns
Please visit Ondernemers: Aangiften aanvullen of wijzigen (available in Dutch only)

If you are not able to change your data via one of the previous options, for example, if your name has been misspelled, please write us a letter. Set out which data you want to have changed. Also include your citizen service number (BSN) and contact details, such as your name, address, postal code and place of residence, and the telephone number on which you can be reached during the day. Send your letter to:

Belastingdienst
Postbus 2508
6401 DA Heerlen

The Tax and Customs Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.

If your personal data are indeed incorrect or incomplete, the Tax and Customs Administration will correct it. You will receive a message about this.

as the Tax and Customs Administration given these incorrect personal details to other organisations? In that case, the Tax and Customs Administration will provide the right data the next time around.

To the top of this page

Do you want to have your personal data erased?

In some cases, you may have the right to have your personal information that we have on you erased. This is possible, for example, if we keep information about you that is not or no longer needed to carry out our work.

Can you not delete the data yourself by changing your data? (see above: Do you want to change your data?) Then write a letter. Please state what information is not (or no longer) necessary in your opinion to carry out the Tax and Customs Administration's work properly. Send your letter to:

Belastingdienst
Postbus 2508
6401 DA Heerlen

The Tax and Customs Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.

Does the Tax and Customs Administration agree with you? In that case, the Tax and Customs Administration will remove the data from the administration.
Do we refuse to delete your data? If so, you will receive a decision stating why the Tax and Customs Administration rejects your request.

To the top of this page

Do you want to object to the processing of your personal data?

If you do not want your data to be used by the Tax and Customs Administration, for example for certain calculations or for other activities involving the levying of taxes or the payment of benefits, you can put in a request with the Tax and Customs Administration. Write a letter. Please state which data may not be used in which calculations or activities.

Send your letter to:

Belastingdienst
Postbus 2508
6401 DA Heerlen

The Tax and Customs Administration will usually respond to your request within 1 month. If necessary, we can extend this period by 2 months. If that happens, you will be notified accordingly.

Does the Tax and Customs Administration agree with you? In that case, we will not use the data mentioned. You will be notified.
Do we not agree with you? If so, you will receive a decision stating why the Tax and Customs Administration rejects your request.

To the top of this page

Do you want to restrict the processing of your personal data?

If you are of the opinion that the Tax and Customs Administration is not allowed to use certain data you can make a request to restrict the processing. This can be done, for example:

  • if your personal data is incorrect
  • if you are of the opinion that the processing by the Tax and Customs Administration is unlawful
  • if you consider that certain data are no longer required for processing
  • if you have objected to a processing operation and are awaiting the decision on it

Write a letter and please state which data you want to restrict the processing of.

Send your letter to:

Belastingdienst
Postbus 2508
6401 DA Heerlen

To the top of this page

What does the Data Protection Officer do?

The Ministry of Finance has appointed a Data Protection Officer. The Data Protection Officer checks whether the rules for the protection of personal data are properly applied and complied with by the Tax and Customs Administration. The Data Protection Officer is an internal supervisor and has an independent position. More information about the duties of the Data Protection Officer can be found on the website of the Dutch Data Protection Authority (Dutch DPA) Autoriteit Persoonsgegevens (available in Dutch only).

To the top of this page

Do you have a question or a complaint in connection with the processing of your personal data?

Do you have a question about the way in which the Tax and Customs Administration handles your personal data or a complaint in connection with the implementation of the GDPR? If so, write a letter. State your complaint or question and state that it concerns the Netherlands Tax and Customs Administration.

Send your letter to:
Ministerie van Financiën
Functionaris voor Gegevensbescherming
Postbus 20 201
2500 EE  Den Haag
Send your email to: fg@minfin.nl.

The Dutch DPA monitors compliance with privacy legislation externally. You have the right to lodge a complaint with the authority about the Tax and Customs Administration.

To the top of this page

Looking for more information about the General Data Protection Regulation (GDPR)?

You can find more information about the GDPR on or in the following:

To the top of this page

Javascript is disabled in this web browser. You must activate Javascript in order to view this website.