The Dutch government has blocked U.S. technology company Kyndryl from acquiring Solvinity, the hosting provider behind the Netherlands’ DigiD national identity platform used by more than 16 million citizens. Officials cited national security and data sovereignty concerns as the primary reasons for stopping the deal.
The decision was announced by Dutch Minister for the Digital Economy and Sovereignty Willemijn Aerdts after a review conducted by the Investment Assessment Office (BTI), the agency responsible for evaluating foreign acquisitions that could affect national security. According to the minister, investigators concluded the acquisition could pose risks to the Dutch public interest.
Kyndryl, a U.S.-based IT infrastructure and managed services company spun off from IBM in 2021, announced plans to acquire Solvinity in late 2025. The proposal quickly triggered backlash from Dutch politicians, cybersecurity experts, privacy advocates, and civil society groups concerned about foreign control over critical digital infrastructure.
DigiD functions as the Netherlands’ primary digital authentication system and is widely used for access to government services, including tax filings, healthcare systems, pension services, municipalities, unemployment agencies, and secure public sector communications.
Critics of the takeover argued that transferring control of Solvinity to an American company could expose sensitive Dutch citizen data to U.S. legal jurisdiction under the CLOUD Act. The law allows American authorities to compel U.S.-based companies to provide access to data, even if that data is stored outside the United States.
Privacy advocates and technology experts also warned the acquisition could create strategic dependency risks involving critical national infrastructure. Some opponents described DigiD as a potential “kill switch” because disruption of the platform could affect communication with key public services and institutions.
The proposed acquisition became politically controversial earlier this year after Dutch lawmakers passed motions urging the government to intervene. Coalition parties, including VVD, D66, and CDA, publicly opposed the sale, arguing that strategic digital infrastructure should remain under Dutch or European control.
Several legal challenges were also launched in an attempt to stop the transaction. Journalists, privacy organizations, and technology researchers filed lawsuits against the Dutch state, while Logius privacy officer Pieter van Oordt publicly campaigned against the takeover before reportedly being dismissed from his role.
Kyndryl responded by criticizing the Dutch government’s decision, saying it was “extremely disappointed” and arguing the acquisition would have strengthened Solvinity’s capabilities and benefited Dutch citizens. The company also claimed it had worked with Dutch authorities in good faith throughout the review process.
Dutch officials emphasized that the decision was not specifically aimed at American companies. Minister Aerdts stated the review process was “country-neutral, risk-based, and proportionate,” while reiterating that the Netherlands values foreign technology investment.